Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

HCL BigFix AEX lets attackers upload files and view them

CVE-2026-67073 · published 7 days ago
Summary

The BigFix AEX component can accept any file without checking its type and does not properly restrict who can see uploaded content. An attacker could place harmful files on the server and then retrieve or view sensitive data, leading to possible data leaks or system takeover. Apply the vendor's security updates and restrict file upload permissions immediately.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hcl software bigfix aex v13.0.0.1
Original advisory text
HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
CWE-79Cross-site Scripting (XSS)
CWE-552Files or Directories Accessible to External Parties
CWE-284Improper Access Control
Timeline
Published28 Oct 2026
Updated4 Nov 2026
First seen28 Oct 2026
Sources
CVE-2026-67073 · NVD
CVE-2026-67073 · MITRE
Track software like this
Free during beta