CVE-2026-67104: HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need network access to publicly accessible JavaScript files served by the affected HCL BigFix Service Management deployment.
What information can be exposed through this vulnerability?
The publicly accessible JavaScript files can reveal hidden administrative API endpoints. The described impact is endpoint discovery that may support further targeted exploitation.
How can I determine whether my deployment is exposed?
Check whether JavaScript files from your HCL BigFix Service Management instance are publicly accessible and whether they contain references to hidden administrative API endpoints. The provided information does not identify affected versions or a specific configuration condition.