TI-2026-40822 Aliases CVE-2026-56595 GHSA-x4m7-q7pg-96vr

HCL BigFix Service Management is affected by multiple security vulnerabilities.

LOW 19CWE-942Published 2026-09-18 · Updated 2026-09-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00149 4th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HCL Software	HCL BigFix Service Management	v27	—	No fix listed	CNA

HCL BigFix Service Management VendorHCL Software Affected v27 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:hcltech:bigfix_service_management:23:-::::::	23	Vulnerable	HCL Software
cpe:2.3:a:hcltech:bigfix_service_management:27:-::::::	27	Vulnerable	HCL Software

cpe:2.3:a:hcltech:bigfix_service_management:23:-:*:*:*:*:*:* Versions 23 Vulnerable ·HCL Software
cpe:2.3:a:hcltech:bigfix_service_management:27:-:*:*:*:*:*:* Versions 27 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-56595
2026-10-03 Alias added: GHSA-x4m7-q7pg-96vr
2026-10-15 CVSS score added · NVD

References

Advisory 1

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133917

TI-2026-47494 HCL BigFix Service Management is affected by multiple security vulnerabilities. CVSS 3.1CRITICAL 9.8
TI-2026-40821 HCL BigFix Service Management is affected by multiple security vulnerabilities. CVSS 3.1CRITICAL 9.8
TI-2026-47495 HCL BigFix Service Management is affected by multiple security vulnerabilities. CVSS 3.1CRITICAL 9.3
TI-2026-40820 HCL BigFix Service Management is affected by multiple security vulnerabilities. CVSS 3.1CRITICAL 9.8
TI-2026-17536 HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806) CVSS 3.1CRITICAL 9.8
TI-2025-23103 HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of… CVSS 3.1CRITICAL 9.8

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences