CVE-2026-21830

LowCVSS 3.7

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Summary

HCL BigFix AEX is affected by a vulnerability in the aws-sdk package. It may cause AWS API requests to be sent to unintended or non-AWS endpoints.

Risk Assessment

API requests may be directed to unauthorized endpoints, risking data leakage or unexpected actions in the cloud environment.

Recommendation

Update HCL BigFix AEX to a patched version and verify the AWS endpoint configuration used by the application.

Other vulnerabilities in aws-sdk

GHSA-6475-r3vj-m8vfLow
The vulnerability involves the ability to set an invalid value for the region input field when calling AWS services using the SDK. An actor with access to the environment where the SDK is used can set an invalid region value.

Original NVD description (English source)

HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS