Low severity · published Apr 1, 2026
CVE-2026-21767
HCL BigFix Platform is affected by insufficient authentication
3.3
CVSS
0.1%
EPSS
No
On KEV
Description
HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the application without proper authentication.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
BigFix Platform · HCLSoftware
11.0.0 - 11.0.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21767
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21767
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129906
More from BigFix Platform
7.8
CVE-2026-21765
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys