CVE-2026-21848: HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker can exploit the improper access controls. The available information does not identify which authenticated roles or privilege levels are required.
What is the potential impact?
The issue may allow unauthorized viewing of restricted data elements across tenant boundaries. The stated impact is confidentiality exposure; integrity and availability impacts are not indicated.
Are default deployments affected?
The available information does not state whether the vulnerable access-control condition exists in a default configuration.
How can an organization determine whether it is affected?
Review access-control behavior in HCL BigFix Service Management, particularly whether authenticated users can view restricted data belonging to other tenants. The provided information does not include affected versions or specific detection indicators.