CVE-2026-67073

HCL BigFix AEX is affected by multiple security vulnerabilities.

State: Published
Severity: 8.6 High
Published: Oct 28, 2026
Updated: Oct 28, 2026
Reserved: Jul 28, 2026

Description

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L	HCL

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-552 Files or Directories Accessible to External Parties
CWE-284 Improper Access Control

Affected Products

Product	Versions
BigFix AEXHCL Software	v13.0.0.1Affected

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134281

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.