EUVD-2026-82876
GHSA-6qc5-jgrf-h9g7
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable but session-ID prediction makes AC:H; authenticated foothold needed so PR:L; retained vendor's conservative C:L/I:N/A:N given the vector-vs-description impact conflict.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
3DescriptionCVE.org
HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers. Successful exploitation allows an attacker to compromise affected administrative sessions and execute actions with full privileged user permissions.
AnalysisAI
HCL BigFix Service Management permits multiple simultaneous authenticated sessions for the same administrative account, creating an administrative session concurrency weakness tracked as CVE-2026-21806. An attacker who already has a low-privileged authenticated foothold (PR:L) could, under high-complexity conditions (AC:H), attempt to predict or hijack a valid administrator session identifier while an administrator is actively logged in, with successful exploitation allowing actions using that administrator's permissions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the BigFix Service Management application to permit multiple simultaneous authenticated sessions for the same administrative account (the vulnerable default behavior described), plus an existing authenticated foothold (PR:L) to attempt session-identifier prediction or hijacking. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue despite the alarming description language. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed release referenced by HCL advisory KB0133592; the provided intelligence does not specify an exact patched version, so verify the current fixed build through HCL support. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative scr
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Cross-site scripting in HCL BigFix Service Management lets an attacker who already holds a valid low-privilege account (
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user intera
Inadequate account lockout controls in HCL BigFix Service Management allow unauthenticated remote attackers to conduct s
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read s
Share
External POC / Exploit Code
Leaving vuln.today