EUVD-2026-112032
GHSA-wqc7-896p-vr96
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure authenticated AEX user to malicious page
-
DeliveryFrame BigFix AEX in hidden iframe
-
ExploitOverlay deceptive clickable UI
-
ExecutionVictim clicks framed control
-
ImpactUnauthorized action in victim session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Clickjacking prevention, X-Frame-Options
|
| Exploitation Conditions | Exploitation requires the HCL BigFix AEX web interface to be framable - i.e., it must not enforce anti-framing controls such as an X-Frame-Options or Content-Security-Policy frame-ancestors header (the KB reference does not specify the exact missing control). The victim must be an authenticated AEX user (per PR:L) with an active session and must be socially engineered into visiting the attacker's page and clicking the overlaid/framed UI. Limiting factors: the attack yields only actions the victim's own account can perform, it fails if the user is not logged in or does not interact, and it is defeated by browser frame-busting or any deployment already sending anti-clickjacking response headers. |
| Impact | This is a moderate, not urgent, issue. The vuln.today decision label is 'this_month' (not act_now/emergency), and no amplifying exploitation signals are present: there is no CISA KEV listing, no EPSS score, and no public exploit code - the sole reference is an HCL support KB article, not a PoC. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L, 6.4) is internally questionable for a clickjacking flaw: clickjacking (CWE-1021) inherently requires a victim to interact with a framed page, yet the vector lists UI:N, and it rates C:H (high confidentiality loss) which is atypical for a UI-redress attack whose primary effect is unauthorized actions (integrity) - these should be verified with HCL. Weighing the real signals, this is a high-CVSS-leaning-but-low-real-risk item: exploitation depends on social engineering an already-authenticated BigFix AEX user (PR:L) into interacting with an attacker-controlled frame, there is no evidence of exploitation, and the realistic impact is bounded unauthorized actions within the victim's existing session rather than broad compromise. |
| Exploit ScenarioDerived | An attacker hosts a malicious web page that loads the HCL BigFix AEX interface inside a hidden or transparent iframe and overlays deceptive UI elements, then lures an authenticated AEX user to the page. When the victim clicks what appears to be benign content, the click is actually directed at the framed AEX application, causing an unintended account change or transaction. No public exploit code is identified at time of analysis; the attack is standard UI-redress (frame overlay) and requires the victim to be logged in and to interact. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Clickjacking in the HCL BigFix AEX web interface allows remote attackers to embed the application in a malicious page or iframe and trick a logged-in administrator or operator into performing unintended actions with their own privileges, which can result in unauthorized configuration or account changes. The flaw is a missing or ineffective anti-framing control (CWE-1021); the supplied vendor advisory reference (KB0134281) does not specify which control is absent, and the CPE entry (cpe:2.3:a:hcl_software:bigfix_aex) carries no version boundary, so the affected build range is not enumerated in the available data. Exploitation depends on a victim with an active AEX session being socially engineered into visiting the attacker's page and interacting with the overlaid UI, so it fails against logged-out users and against deployments that already emit X-Frame-Options or a CSP frame-ancestors directive; no public exploit was identified at time of analysis and the issue is not in CISA KEV. Our independent assessment rates this moderate and not urgent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), narrower in impact than the vendor's 6.4 score, with the priority label indicating remediation is appropriate within the current monthly cycle rather than as an emergency.
RemediationAI
The supplied data contains no fixed version and no patch reference beyond the vendor KB article (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134281), so no vendor-released patch version can be cited here; consult that article for the current fixed build and upgrade path, and treat the absence of a version in this dataset as a gap rather than confirmation that no fix was issued. Until an upgraded build is deployed, the compensating control indicated by the evidence is to make the AEX web interface unframable: emit X-Frame-Options: DENY (or SAMEORIGIN where same-origin framing is genuinely needed) and a Content-Security-Policy frame-ancestors directive on all authenticated AEX responses, applied at the reverse proxy or web tier if the application cannot be changed; the trade-off is that any legitimate dashboard, portal, or ticketing integration that embeds AEX in an iframe will break and must be allowlisted explicitly. Browser-side frame-busting scripts are a weaker, easily bypassed substitute and should not be relied on alone. Users should also be kept signed out of AEX when not actively working and trained not to click through unexpected overlay pages, though this reduces rather than removes exposure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Clickjacking is the CWE-1021 class of improper restriction of rendered UI layers or frames: a browser will render a target site inside an attacker-controlled iframe unless the site explicitly refuses to be framed. The technical mechanism is a missing or misconfigured response control such as X-Frame-Options (DENY/SAMEORIGIN) or a Content-Security-Policy frame-ancestors directive; per the assessment, the BigFix AEX web interface must be framable for the attack to work, and the HCL KB article does not state which specific header or directive is missing or on which endpoint. Because the framed page executes in the victim's authenticated browser context, any click or keystroke the attacker can align over a real control is performed with the victim's own session and privileges, which is why the vendor vector carries PR:L and a confidentiality rating while our assessment caps impact at integrity-only with a required user interaction. Note that the supplied intelligence tags also list XSS alongside the product name, but no cross-site scripting mechanism is described in the description or the advisory reference, and the two signals should not be conflated. The vendor scores AC:H/UI:N with C:H/I:L/A:L, while our independent analysis scores the same flaw as AC:L/UI:R with C:N/I:L/A:N; the divergence is about how reliably a user can be induced to interact and how much data the framed UI can actually leak, not about whether framing is possible.
Know when Bigfix Aex gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Clickjacking needs no attacker privileges (PR:N) but a tricked victim click (UI:R); impact is limited unauthorized actions in the victim's session (I:L), with no direct confidentiality or availability loss.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
DescriptionCVE.org
HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthorized transactions or changes to their accounts.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Bigfix Aex
View allRemote code execution in HCL BigFix AEX is reachable over the network with low attack complexity, but the CVSS vector re
Unauthenticated remote file upload and direct retrieval weaknesses in HCL BigFix AEX allow attackers to place files on t
HCL BigFix AEX discloses sensitive technical detail - stack traces, system information and internal file paths - through
Server-side request forgery in HCL BigFix AEX lets an authenticated low-privilege user induce the application to send re
HCL BigFix AEX V13.0 contains a flaw in its bundled aws-sdk package that can cause AWS API requests to be directed to un
Exploit-DB