CVE-2026-67106: HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the affected API endpoints?
The severity vector indicates network-based exploitation with no privileges or user interaction required. An unauthenticated remote attacker could access the exposed endpoints if they are reachable over the network.
What is the direct impact of successful exploitation?
The exposed API endpoints can return sensitive data, resulting in information disclosure. The disclosed information could help an attacker prepare or enable more serious follow-on attacks.
Does exploitation modify data or disrupt service availability?
The provided severity vector indicates low confidentiality impact and no integrity or availability impact. The described issue is limited to disclosure of sensitive information from two API endpoints.