Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.8

HCL BigFix Service Management can be tricked into internal requests

CVE-2026-67101 · published 22 days ago
Summary

The search feature in HCL BigFix Service Management lets a remote user cause the server to reach internal network resources that are not exposed to the Internet. This could let an attacker discover or interact with internal services. Apply the vendor's security update or restrict access to the search function until the patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hcl software hcl bigfix service management V23
hcltech bigfix_service_management 23
27
cpe:2.3:a:hcltech:bigfix_service_management:23:-:*:*:*:*:*:*
Original advisory text
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published18 Sep 2026
Updated10 Oct 2026
First seen18 Sep 2026
Sources
CVE-2026-67101 · NVD
CVE-2026-67101 · MITRE
Track software like this
Free during beta