HCL BigFix AEX EUVD-2026-112030

Exploitation targets the file-upload feature of HCL BigFix AEX combined with an access-control weakness that lets uploaded content be fetched or downloaded directly. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is reachable remotely with no authentication, no user interaction, and low complexity against the application as described - the available sources do not name a non-default setting or deployment mode that must be enabled, so no special precondition beyond network reachability to the AEX application instance is documented. The principal limiting factor is that an attacker must be able to reach the AEX service over the network (internet-exposed instances are at materially higher risk than internal-only deployments); the description does not detail whether upload or retrieval is constrained to specific endpoints, so the precise trigger is not fully described in the available sources.

This is a credible high-priority issue rather than an inflated CVSS score, but it falls short of emergency status given the current signal set. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, 8.6) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, which is consistent with the described combination of unrestricted file upload (CWE-434) and improper access control allowing direct retrieval of uploaded content. The vuln.today decision label is 'this_week', indicating prompt but not immediate action. No CISA KEV listing is present and no EPSS score was supplied, so there is no evidence of active exploitation or a quantified exploitation probability - this should be treated as not-yet-exploited rather than confirmed safe. The only reference is an HCL support/KB advisory, which is a vendor knowledge-base article, not proof-of-concept exploit code. The main tension to flag: the CVSS marks C:H but only I:L/A:L, whereas the description speculates 'system compromise' from uploading malicious files; the impact metrics and the narrative prose are not fully aligned, so the worst-case 'system compromise' outcome is unverified and should be confirmed with HCL before being treated as established.

A remote attacker reachable over the network interacts with the BigFix AEX file-upload functionality to place a malicious or unauthorized file, then abuses the improper access control to directly request and download sensitive uploaded content belonging to other users or the system. No public proof-of-concept or exploit code was identified in the provided sources; the single reference is a vendor knowledge-base advisory. Per the CVSS vector the attack is low-complexity and requires no authentication or user interaction.