CVE-2026-67101
mediumpriority · track · 23EPSS 0.003 · 17 %ileDEUSEPSS · scored 2026-10-27
HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 5.3–9.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (9)
Products and version ranges known to be affected.
- HCL BigFix Service Management v23all versionscert_bundDEcpe:/a:hcltech:bigfix:service_management_v23
- hcltech bigfix service management= 23nvdUScpe:2.3:a:hcltech:bigfix_service_management:*:*:*:*:*:*:*:*
- hcltech bigfix service management= 27nvdUScpe:2.3:a:hcltech:bigfix_service_management:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3461HCL BigFix Service Management: Mehrere SchwachstellenDeutsch2026-09-17csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Sicherheitsmaßnahmen zu umgehen, erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, Daten offenzulegen oder zu manipulieren, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen oder serverseitige Request-Forgery- sowie Brute-Force- und Session-Hijacking-Angriffe auszuführen.
sources
Which sources assert this record, and when.
references (1) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan