CVE-2026-108018: BigFix Mobile is affected by sensitive information disclosure
Published Nov 6, 2026
·Updated
The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the BigFix MCM admin portal through a VPN or other network restriction so it is not directly accessible from the internet.
Event History
Nov 6, 2026
CVE Published
via MITRE·08:27 AM
Data Sourced
via MITRE·08:27 AM
DescriptionSeverityWeakness