CVE-2026-67074
CriticalCVSS 9.1Summary
HCL BigFix AEX is affected by a Remote Code Execution (RCE) vulnerability. An attacker may execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.
Risk Assessment
An RCE flaw in BigFix AEX could allow an attacker to gain full control of the system and access managed resources. This poses a serious risk to the confidentiality, integrity, and availability of the infrastructure managed by BigFix.
Recommendation
Immediately update HCL BigFix AEX to a patched version and restrict network access to management interfaces. Also review logs for suspicious activity.
Other vulnerabilities in HCL BigFix AEX
See all- CVE-2026-67080Medium
HCL BigFix AEX is affected by an information disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths.
- CVE-2026-67079Medium
HCL BigFix AEX is affected by a clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthorized transactions or changes to their accounts.
- CVE-2026-67077Medium
HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or unauthorized actions through the affected application.
- CVE-2026-67073High
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. An attacker could upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.
Original NVD description (English source)
HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS