EUVD-2026-82769
GHSA-w455-4v8x-45rh
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Authenticated user injects script (PR:L) firing only when a victim views it (UI:R), crossing into the victim's browser context (S:C); standard XSS confidentiality/integrity impact is Low, not High.
Primary rating from Vendor (hcl).
CVSS VectorVendor: hcl
Lifecycle Timeline
3DescriptionCVE.org
HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.
AnalysisAI
Cross-site scripting in HCL BigFix Service Management lets an attacker who already holds a valid low-privilege account (CVSS PR:L) inject unsanitized script into content that executes in another user's browser when that user views it (UI:R), enabling session hijacking, account takeover, and unauthorized actions performed as the victim. Impact is greatest when the viewing victim is a higher-privileged user such as an agent or administrator, because the injected script then runs with that user's session context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account on HCL BigFix Service Management (PR:L) and victim user interaction (UI:R) - the injected script only executes when another user renders the attacker-controlled content in their browser. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority XSS in a niche enterprise ITSM module. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is stated in the available data, so patch status is unconfirmed; administrators should monitor HCL support article KB0133782 for the fixed build and apply it as soon as HCL publishes it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every deployment of HCL BigFix Service Management across the estate (including non-production and regional instances), record the running version of the ITSM module and its WebUI/reporting components, and open a tracking ticket with the vendor for CVE-2026-67103; simultaneously reduce the attack surface by reviewing which accounts hold access to the affected content areas and disabling any unused or stale low-privilege accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative scr
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user intera
Inadequate account lockout controls in HCL BigFix Service Management allow unauthenticated remote attackers to conduct s
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read s
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today