CVE-2026-67100
criticalpriority · track · 0EPSS 0.005 · 40 %ileDEUSEPSS · scored 2026-10-27
HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (9)
Products and version ranges known to be affected.
- HCL BigFix Service Management v23all versionscert_bundDEcpe:/a:hcltech:bigfix:service_management_v23
- hcltech bigfix service management= 23nvdUScpe:2.3:a:hcltech:bigfix_service_management:*:*:*:*:*:*:*:*
- hcltech bigfix service management= 27nvdUScpe:2.3:a:hcltech:bigfix_service_management:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3461HCL BigFix Service Management: Mehrere SchwachstellenDeutsch2026-09-17csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Sicherheitsmaßnahmen zu umgehen, erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen oder serverseitige Request-Forgery- sowie Brute-Force- und Session-Hijacking-Angriffe auszuführen.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan