CVE-2026-56599
HCL BigFix Service Management is affected by multiple security vulnerabilities.
- State
- Published
- Severity
- 2.2 Low
- Published
- Oct 1, 2026
- Updated
- Oct 1, 2026
- Reserved
- Jun 22, 2026
Description
HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 2.2 Low | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N | HCL |
Weaknesses
- CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Affected Products
| Product | Versions |
|---|---|
HCL BigFix Service ManagementHCL Software |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.