BigFix Service Management EUVD-2026-90874

Exploitation requires (1) a stored/persistent input field in HCL BigFix Service Management that renders attacker-supplied content without output encoding, and (2) a victim subsequently viewing the page that displays the stored payload - the victim-view step (user interaction) is an inherent limiting factor despite the supplied vector's UI:N. The impact is bounded to the victim's browser/session context (session hijacking, theft of data the victim can access), not direct server compromise. Whether the injecting attacker needs authentication is not confirmed by the advisory; the supplied PR:N should be independently verified against the specific affected field. No affected/fixed version range is enumerated in the provided reference.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2) is internally inconsistent with a stored XSS whose own description states the payload 'executes when a victim views the affected page' - that is textbook user interaction (UI:R), yet the vector claims UI:N. This inconsistency inflates the HCL-reported score; a UI:R assessment lands closer to the mid-6 range. PR:N is also questionable because persisting script typically requires at least a low-privileged account or a reachable input field, and the description does not confirm unauthenticated injection - treat the auth requirement as unconfirmed. On the exploitation-likelihood side, there is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so this is no public exploit identified at time of analysis - a low real-world-exploitation signal. Net: this is a genuine but not emergency issue. The confidentiality/integrity impacts are both Low and there is no availability impact; the scope change (S:C) reflects script crossing into the victim's browser/session rather than a catastrophic server compromise. Priority is moderate for environments running the affected HCL module, driven by the credible session-hijacking outcome, not by any evidence of active exploitation.

An attacker submits a crafted input containing a malicious script into a field of HCL BigFix Service Management that is later rendered without proper output encoding. When a legitimate user - often a help-desk operator or administrator - opens the page displaying that stored content, the script runs in their authenticated session, allowing session-token theft or exfiltration of data visible to that user. No public exploit code is identified at time of analysis, and the attack depends on a victim viewing the affected page.