High severity · published May 6, 2026
CVE-2025-52613
HCL BigFix Service Management (SM) is affected by use of a vulnerable component
8.8
CVSS
0.2%
EPSS
No
On KEV
Description
HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
BigFix Service Management (SM) · HCL
23 · source: vendor
BS
Bigfix Service Management · Hcltech
23.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52613
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144
More from BigFix Service Management (SM)
9.8
CVE-2025-31973
HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'
8.3
CVE-2024-30151
HCL BigFix Service Management (SM) is susceptible to Broken Access Control Vulnerability
6.5
CVE-2025-31985
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header
5.4
CVE-2025-31984
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header
5.3
CVE-2025-31960
HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module