Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

HCL BigFix Service Management can leak data in error messages

CVE-2026-67172 · published 17 days ago
Summary

The HCL BigFix Service Management system may include sensitive details in its error replies when it receives malformed requests. This extra information could help a malicious user plan additional attacks. Apply the latest security patches or contact HCL for an updated version to stop the data leakage.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hcl software hcl bigfix service management Version 27
Original advisory text
HCL BigFix Service Management is affected by multiple security vulnerabilities.
HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-209Generation of Error Message Containing Sensitive Information
Timeline
Published1 Oct 2026
Updated14 Oct 2026
First seen1 Oct 2026
Sources
CVE-2026-67172 · NVD
CVE-2026-67172 · MITRE
Track software like this
Free during beta