CVE-2026-67104

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.

Score

CVSS 3.1 5.3 Medium

Status

Analyzed - psirt@hcl.com

Published

2026-10-01

Last modified

2026-10-05

Weaknesses

CWE-200, CWE-798

Affected products

• Hcl Bigfix Service Management (Hcl Software)
• Bigfix Service Management (Hcltech)

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134015