Vulnerability · Published May 27, 2026 · Assigned by HCL
CVE-2026-21785HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy
Medium 4.0
In plain English
A medium-severity security flaw in BigFix Remote Control Server from HCLSoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.1%top 95.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCLSoftware | BigFix Remote Control Server | <= versions 10.1.0.0442 |
Weakness: CWE-1021 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N