Medium severity · published Oct 28, 2026
CVE-2026-67077
HCL BigFix AEX is affected by multiple security vulnerabilities.
New
4.2
CVSS
–
EPSS
No
On KEV
Description
HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or unauthorized actions through the affected application.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
BigFix AEX · HCL Software
v13.0.0.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67077
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67077
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134281
More from BigFix AEX
9.1
CVE-2026-67074
HCL BigFix AEX is affected by multiple security vulnerabilities.
8.6
CVE-2026-67073
HCL BigFix AEX is affected by multiple security vulnerabilities.
6.5
CVE-2026-67080
HCL BigFix AEX is affected by multiple security vulnerabilities.
6.4
CVE-2026-67079
HCL BigFix AEX is affected by multiple security vulnerabilities.
3.7
CVE-2026-21830
HCL BigFix AEX is affected by multiple security vulnerabilities.