CVE-2026-67101

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

CVSS v3 9.3 CRITICAL

9.3^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hcltech:bigfix_service_management:23:-::::::
	cpe:2.3:a:hcltech:bigfix_service_management:27:-::::::

History

08 Oct 2026, 20:36

Type	Values Removed	Values Added
References	~~() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782 -~~	() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782 - Vendor Advisory
CPE		cpe:2.3:a:hcltech:bigfix_service_management:23:-:::::: cpe:2.3:a:hcltech:bigfix_service_management:27:-::::::
First Time		Hcltech bigfix Service Management Hcltech

18 Sep 2026, 08:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-18 08:17

Updated : 2026-10-08 20:36

NVD link : CVE-2026-67101

Mitre link : CVE-2026-67101

CVE.ORG link : CVE-2026-67101

JSON object : View

Products Affected

hcltech

bigfix_service_management

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-67101", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67101", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T18:13:08.816315Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "HCL BigFix Service Management", "versions": [{"status": "affected", "version": "V23"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-18T08:17:00.740", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet."}], "lastModified": "2026-10-08T20:36:46.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:bigfix_service_management:23:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "87883B36-49A4-4EB9-BA3B-AD0CB4EDC061"}, {"criteria": "cpe:2.3:a:hcltech:bigfix_service_management:27:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08B2E58A-98AF-44B9-A25D-84B0A4B209CC"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}