HCL BigFix AEX EUVD-2026-112033

Exploitation requires an authenticated session at low privilege (PR:L) against HCL BigFix AEX; it is not a default-configuration, unauthenticated remote flaw. The CVSS vector also reflects high attack complexity (AC:H), indicating conditions beyond the attacker's direct control must be met, but the available sources do not describe the exact feature, parameter, protocol handler, or configuration that triggers the server-side request - the trigger is not described in the available sources. Limiting factors confirmed from the data: valid credentials are needed, impact is limited to Low confidentiality and Low integrity with no availability effect, and scope is unchanged (S:U), so the SSRF acts within the application's own privilege context.

This is a moderate-severity, lower-priority issue rather than an urgent one. The supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2) indicates a network-reachable flaw that nonetheless requires authentication (PR:L) and has high attack complexity (AC:H), with only Low confidentiality and Low integrity impact and no availability impact. The vuln.today decision label is 'this_month,' consistent with a non-emergency, scheduled-remediation posture. There is no CISA KEV listing and no EPSS score in the provided data, so there is no signal of active exploitation or statistically elevated exploitation probability; absence of these is not itself an error but means widespread-exploitation evidence is lacking. The only reference is an HCL support KB article (vendor advisory), not a proof-of-concept, so no public exploit is indicated. Note the AC:H rating is not explained by the available sources - the description does not state why complexity is high, so treat the 'high complexity' characterization as vendor-assigned, not mechanistically confirmed. Overall: a real but low-urgency SSRF whose main value to an attacker is pivoting/information disclosure, gated by the need for existing low-privilege authenticated access.

An authenticated low-privilege user of HCL BigFix AEX supplies or influences a URL/endpoint the application then fetches, coercing the server to issue requests to internal or external resources it should not reach. This could expose internal services or sensitive responses, or trigger unauthorized actions via the application's server-side context. No public exploit code is identified, and the exploit requires valid credentials plus conditions reflected by the high attack complexity.