Hcl Bigfix Service Management
Monthly
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make the application server issue requests to internal systems that are not reachable from the internet, potentially exposing internal APIs, admin interfaces, or cloud metadata services. The vendor scores this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but our independent assessment places it lower: the scope-change and high-confidentiality components are contestable, and realistic impact depends on whether the deployment has internal routes worth abusing and on whether responses are reflected to the attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, though the unauthenticated, no-interaction attack profile (PR:N/UI:N) makes this a strong candidate for automated scanning against internet-exposed instances.
HCL BigFix Service Management permits multiple simultaneous authenticated sessions for the same administrative account, creating an administrative session concurrency weakness tracked as CVE-2026-21806. An attacker who already has a low-privileged authenticated foothold (PR:L) could, under high-complexity conditions (AC:H), attempt to predict or hijack a valid administrator session identifier while an administrator is actively logged in, with successful exploitation allowing actions using that administrator's permissions. The assessed CVSS base score is 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), no public exploit code has been identified at time of analysis, and this is a low-priority issue despite the alarming description language.
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly validated, allowing an attacker-controlled web page to issue credentialed cross-origin requests and read or manipulate protected resources and restricted APIs using an already-authenticated victim's session. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.1) confirms the attacker needs no account on the application, but the attack only succeeds against a victim who is currently logged in to BigFix Service Management and is lured into visiting the malicious page in the same browser, which is why it is rated high complexity (AC:H). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; combined with the niche deployment of this HCL ITSM module, the practical risk is low, with limited integrity impact and no confirmed confidentiality impact in the published scoring (our internal assessment scopes confidentiality slightly higher, at low).
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error messages, or rendered page content - allowing anyone able to reach the instance to harvest RFC1918 addressing and infer the internal network topology behind it. The consequence is reconnaissance only: no data modification, no service disruption, and a low vendor base score of 3.1, making this a low-priority item rather than an urgent one. No public exploit code was identified at time of analysis and there is no KEV or EPSS signal in the supplied data. The vendor vector specifies PR:L (a valid session) while the description claims an unauthenticated attacker, so authentication requirements are not confirmed from available data; the vendor's AC:H also implies an additional non-trivial condition or timing is needed to elicit the leak.
Inadequate account lockout controls in HCL BigFix Service Management allow unauthenticated remote attackers to conduct sustained brute-force attacks against the login interface, potentially leading to unauthorized system access. The vulnerability (CWE-307) is remotely exploitable without authentication or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), but success is limited to weak, reused, or guessable credentials and is effectively mitigated by MFA, rate-limiting, IP throttling, or strong password policies. No public exploit identified at time of analysis, and active exploitation has not been confirmed (not in CISA KEV).
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's upload functionality and, if the payload is subsequently triggered, achieve code execution and full server compromise. The public description characterizes the actor as unauthenticated, while the vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a low-privileged authenticated account plus user interaction at high attack complexity; our own independent assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so the two views differ by both privilege requirement and severity and must be reconciled before prioritization. Exploitation is limited to deployments that expose the vulnerable upload feature and whose validation controls can be bypassed, and there is no public exploit identified at time of analysis.
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one tenant to read restricted data elements belonging to other tenants because of improper access controls. Affected deployments are those operated in shared or multi-tenant mode; the impact is limited to confidentiality (unauthorized viewing), with no modification or disruption of data, and no user interaction is required on the victim's side (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, base 5.0). Exploitation requires a legitimate authenticated foothold in at least one tenant, so this is not remotely exploitable by unauthenticated attackers, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make the application server issue requests to internal systems that are not reachable from the internet, potentially exposing internal APIs, admin interfaces, or cloud metadata services. The vendor scores this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but our independent assessment places it lower: the scope-change and high-confidentiality components are contestable, and realistic impact depends on whether the deployment has internal routes worth abusing and on whether responses are reflected to the attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, though the unauthenticated, no-interaction attack profile (PR:N/UI:N) makes this a strong candidate for automated scanning against internet-exposed instances.
HCL BigFix Service Management permits multiple simultaneous authenticated sessions for the same administrative account, creating an administrative session concurrency weakness tracked as CVE-2026-21806. An attacker who already has a low-privileged authenticated foothold (PR:L) could, under high-complexity conditions (AC:H), attempt to predict or hijack a valid administrator session identifier while an administrator is actively logged in, with successful exploitation allowing actions using that administrator's permissions. The assessed CVSS base score is 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), no public exploit code has been identified at time of analysis, and this is a low-priority issue despite the alarming description language.
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly validated, allowing an attacker-controlled web page to issue credentialed cross-origin requests and read or manipulate protected resources and restricted APIs using an already-authenticated victim's session. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.1) confirms the attacker needs no account on the application, but the attack only succeeds against a victim who is currently logged in to BigFix Service Management and is lured into visiting the malicious page in the same browser, which is why it is rated high complexity (AC:H). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; combined with the niche deployment of this HCL ITSM module, the practical risk is low, with limited integrity impact and no confirmed confidentiality impact in the published scoring (our internal assessment scopes confidentiality slightly higher, at low).
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error messages, or rendered page content - allowing anyone able to reach the instance to harvest RFC1918 addressing and infer the internal network topology behind it. The consequence is reconnaissance only: no data modification, no service disruption, and a low vendor base score of 3.1, making this a low-priority item rather than an urgent one. No public exploit code was identified at time of analysis and there is no KEV or EPSS signal in the supplied data. The vendor vector specifies PR:L (a valid session) while the description claims an unauthenticated attacker, so authentication requirements are not confirmed from available data; the vendor's AC:H also implies an additional non-trivial condition or timing is needed to elicit the leak.
Inadequate account lockout controls in HCL BigFix Service Management allow unauthenticated remote attackers to conduct sustained brute-force attacks against the login interface, potentially leading to unauthorized system access. The vulnerability (CWE-307) is remotely exploitable without authentication or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), but success is limited to weak, reused, or guessable credentials and is effectively mitigated by MFA, rate-limiting, IP throttling, or strong password policies. No public exploit identified at time of analysis, and active exploitation has not been confirmed (not in CISA KEV).
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's upload functionality and, if the payload is subsequently triggered, achieve code execution and full server compromise. The public description characterizes the actor as unauthenticated, while the vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a low-privileged authenticated account plus user interaction at high attack complexity; our own independent assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so the two views differ by both privilege requirement and severity and must be reconciled before prioritization. Exploitation is limited to deployments that expose the vulnerable upload feature and whose validation controls can be bypassed, and there is no public exploit identified at time of analysis.
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one tenant to read restricted data elements belonging to other tenants because of improper access controls. Affected deployments are those operated in shared or multi-tenant mode; the impact is limited to confidentiality (unauthorized viewing), with no modification or disruption of data, and no user interaction is required on the victim's side (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, base 5.0). Exploitation requires a legitimate authenticated foothold in at least one tenant, so this is not remotely exploitable by unauthenticated attackers, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.