CVE-2026-21840

LowCVSS 3.1

Published: 14/07/2026(UTC)Updated: 15/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

HCL BigFix Platform is affected by a user enumeration vulnerability. An attacker, through careful system control and response time monitoring, can determine which users are registered with the BigFix service.

Risk Assessment

The risk is that an attacker can gather a list of valid usernames, which may facilitate further attacks such as brute force or phishing.

Recommendation

Apply the vendor-provided update and implement response time masking mechanisms to hinder user enumeration.

Original NVD description (English source)

HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service.