CVE-2026-108013: HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mozilla CA certificate bundle (PEM) used by HCL BigFix Platformto a version that resolves this vulnerability.Fixed in 2026/10/20
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
BigFix Platform deployments that validate remote servers using a Mozilla CA certificate bundle dated before 2026/10/20 are affected. The risk applies when the platform downloads files from a server an attacker can position themselves between.
What must an attacker be able to do?
An attacker must be on the network path between BigFix Platform and a remote server and use a certificate associated with a compromised private key that remains trusted by the older bundle. Exploitation also depends on the user interacting with the affected download flow.
What should be done if the platform is using an older bundle?
Update the Mozilla CA certificate bundle to version 2026/10/20 or later. The fixed bundle is available starting with BES Support v1520.