Medium severity · published May 6, 2026
CVE-2025-31978
HCL BigFix Service Management (SM) does not adequately sanitize or safely render
4.3
CVSS
0.1%
EPSS
No
On KEV
Description
HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
BigFix Service Management (SM) · HCL Software
23 · source: vendor
BS
Bigfix Service Management · Hcltech
23.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-31978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-31978
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144
More from BigFix Service Management (SM)
7.5
CVE-2025-31976
HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials
7.2
CVE-2025-31974
HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only
6.5
CVE-2025-31982
HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directl
5.7
CVE-2025-31957
HCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.
3.5
CVE-2025-31959
HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images.