Medium severity · published May 6, 2026
CVE-2025-31960
HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
BigFix Service Management (SM) · HCL
23 · source: vendor
BS
Bigfix Service Management · Hcltech
23.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-31960
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-31960
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144
More from BigFix Service Management (SM)
9.8
CVE-2025-31973
HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'
8.8
CVE-2025-52613
HCL BigFix Service Management (SM) is affected by use of a vulnerable component
8.3
CVE-2024-30151
HCL BigFix Service Management (SM) is susceptible to Broken Access Control Vulnerability
6.5
CVE-2025-31985
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header
5.4
CVE-2025-31984
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header