Vulnerability · Published May 6, 2026 · Assigned by HCL
CVE-2025-31983HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header
Low 3.7
In plain English
A low-severity security flaw in BigFix Service Management (SM) from HCL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.1%top 98.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure of sensitive information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCL | BigFix Service Management (SM) | 23 |
Weakness: CWE-358 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L