CVE-2026-67105: HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Environments where an attacker can obtain internal network access are exposed, because the affected traffic is unencrypted HTTP exchanged between backend services.
What does an attacker need to exploit it?
The attacker needs internal network access and the ability to intercept traffic between backend services. No privileges or user interaction are required according to the provided severity vector.
What could an attacker gain from successful interception?
An attacker could extract sensitive data from unencrypted backend-service traffic and potentially perform a man-in-the-middle attack. The provided severity information indicates high confidentiality and integrity impact.