CVE-2026-67101: HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is remotely exploitable with no privileges or user interaction required, as indicated by the AV:N/AC:L/PR:N/UI:N vector. An attacker able to reach the affected application's search functionality could attempt to trigger server-side requests.
What resources are at risk from exploitation?
The application server may be induced to send requests to internal systems that are not directly accessible from the internet. The supplied severity vector indicates high confidentiality impact and low integrity impact, with no availability impact.
Is a default configuration known to be affected?
The provided information does not state whether the vulnerable search functionality is enabled or exposed in default deployments. Confirm whether users can reach the search feature in the deployed HCL BigFix Service Management instance.