TI-2026-80047 Aliases CVE-2026-108013 GHSA-x7j6-r59g-9w4v

HCL BigFix Platform trusts certificates with compromised keys

LOW 31CWE-295Published 2026-10-24 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

HCL BigFix Platform 11.0.7 and below and 10.0.16 and below use a Mozilla CA certificate bundle dated before 2026/10/20. The bundle still trusts certificates whose private keys have been compromised, which is improper certificate validation (CWE-295). An on-path attacker can impersonate remote servers when the application validates them and tamper with files it downloads.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00151 4th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HCL Software	BigFix Platform	Platform 11.0.7 and below + 10.0.16 and below	—	No fix listed	CNA

BigFix Platform VendorHCL Software Affected Platform 11.0.7 and below + 10.0.16 and below Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:hcltech:bigfix_platform::::::::	—	—	HCL Software

cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:* Versions — — ·HCL Software

Remediation

Use Mozilla CA certificate bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Timeline

2026-10-24 Threatist record created from CVE-2026-108013
2026-10-24 Alias added: GHSA-x7j6-r59g-9w4v
2026-10-24 Priority changed: MEDIUM → LOW
2026-11-02 Weakness changed · CISA ADP
2026-11-02 CISA SSVC decision points changed

References

Other 1

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134758

TI-2023-24505 Path Traversal which allows file upload capability affects DRYiCE MyXalytics CVSS 3.1CRITICAL 9.8
TI-2022-22044 Out-of-bounds write in HCL Software Notes CVSS 3.1CRITICAL 9.8
TI-2022-22043 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
TI-2022-22042 Out-of-bounds write in HCL Software Notes CVSS 3.1CRITICAL 9.8
TI-2022-22041 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
TI-2022-22040 Out-of-bounds write in HCL Software Notes CVSS 3.1CRITICAL 9.8

See all 661 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences