Log in Start free

Vulnerability · Published Sep 18, 2026 · Assigned by HCL

CVE-2026-67100HCL BigFix Service Management is affected by multiple security vulnerabilities.

Critical 9.8

In plain English

A critical-severity SQL injection in HCL BigFix Service Management from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

Affected products (as reported)

VendorProductVersions
HCL Software HCL BigFix Service Management V23

Weakness: CWE-89, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References