CVE-2026-56592: HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They can conduct sustained brute-force attempts against the login interface because account lockout protections are inadequate.
Which deployments are exposed?
Deployments with an accessible HCL BigFix Service Management login interface are exposed to sustained brute-force attempts. The provided information does not identify affected versions, configurations, or whether the interface must be internet-facing.
What is the likely impact of successful exploitation?
Successful brute-force attacks could result in unauthorized access to the system. The reported impact includes limited confidentiality and availability effects, with no integrity impact specified.