Medium severity · published May 9, 2026
CVE-2025-15633
HCL BigFix WebUI is affected by an improper authorization vulnerability
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BW
BigFix WebUI · HCLSoftware
all versions · source: vendor
BW
Bigfix Webui Api · Hcltech
before 33 · source: NVD
BW
Bigfix Webui Application Administration · Hcltech
before 40 · source: NVD
BW
Bigfix Webui Cmep · Hcltech
before 22 · source: NVD
BW
Bigfix Webui Common · Hcltech
before 101 · source: NVD
BW
Bigfix Webui Content App · Hcltech
before 28 · source: NVD
BW
Bigfix Webui Custom · Hcltech
before 50 · source: NVD
BW
Bigfix Webui Data Sync · Hcltech
before 37 · source: NVD
BW
Bigfix Webui Extensions · Hcltech
before 14 · source: NVD
BW
Bigfix Webui Framework · Hcltech
before 35 · source: NVD
BW
Bigfix Webui Insights · Hcltech
before 32 · source: NVD
BW
Bigfix Webui Ivr · Hcltech
before 23 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15633
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15633
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130587
More from BigFix WebUI
4.3
CVE-2025-15634
HCL BigFix WebUI is affected by a missing authorization vulnerability