CVE-2026-21765

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129906	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) HCL BigFix Platform se ve afectada por permisos inseguros en claves criptográficas privadas. Las claves criptográficas privadas ubicadas en una máquina host de Windows podrían estar sujetas a permisos de sistema de archivos excesivamente permisivos.

Information

Published : 2026-04-02 00:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-21765

Mitre link : CVE-2026-21765

CVE.ORG link : CVE-2026-21765

JSON object : View

Products Affected

hcltech

bigfix_platform

CWE

CWE-276

Incorrect Default Permissions

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-21765", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21765", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-02T18:20:48.284525Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "BigFix Platform", "versions": [{"status": "affected", "version": "11.0.0 - 11.0.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-02T00:16:23.953", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129906", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-276"}, {"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "HCL BigFix Platform is affected by insecure permissions on private cryptographic keys.\u00a0 The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions."}, {"lang": "es", "value": "HCL BigFix Platform se ve afectada por permisos inseguros en claves criptogr\u00e1ficas privadas. Las claves criptogr\u00e1ficas privadas ubicadas en una m\u00e1quina host de Windows podr\u00edan estar sujetas a permisos de sistema de archivos excesivamente permisivos."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "655B6D28-5486-4ACF-B28F-7346BFB377D0", "versionEndIncluding": "11.0.5", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}