CVE-2026-21808: HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information
Published Aug 26, 2026
·Updated
HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural details.
Affected Software
1 affected component
HCL BigFix Quantum Risk Analyzer
Event History
Aug 26, 2026
CVE Published
via MITRE·10:03 PM
Data Sourced
via MITRE·10:03 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability requires local access and high privileges. Exploitation also has high attack complexity and does not require user interaction.
2
Are default deployments affected?
Yes. The product generates highly detailed logging information by default, creating the sensitive-information exposure risk.
3
What is the expected security impact?
The impact is limited to confidentiality: sensitive information and internal application logic or architectural details may be exposed through logs. No integrity or availability impact is identified.