EUVD-2026-18095
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3Description
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.
Analysis
Local privilege escalation in HCL BigFix Platform on Windows allows authenticated users with low privileges to access cryptographic private keys due to overly permissive file system permissions, potentially enabling complete system compromise with cross-scope impact. Authentication required (PR:L). …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Inventory all Windows systems running HCL BigFix Platform and restrict file system access to BigFix cryptographic key directories using ACLs (remove inherited permissions, grant only SYSTEM and BigFix service account). Within 7 days: Implement compensating controls by auditing recent BigFix service account activity for unauthorized key access and review endpoint vulnerability assessments for suspicious lateral movement. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today