CVE-2026-67103: HCL BigFix Service Management is affected by multiple security vulnerabilities.
Published Sep 18, 2026
·Updated
HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.
Affected Software
1 affected component
HCL BigFix Service Management
Event History
Sep 18, 2026
CVE Published
via MITRE·07:55 AM
Data Sourced
via MITRE·07:55 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker needs low-level privileges and must persuade a victim to interact with the malicious content. The attack can be carried out remotely over the network with low complexity.
2
What is the potential impact if exploitation succeeds?
Malicious scripts can execute in an affected user's browser, potentially enabling session hijacking, account takeover, and unauthorized actions performed as that user. The CVSS vector indicates high confidentiality impact and low integrity impact, with scope changed.