Read the docs
TI-2026-85786 Aliases CVE-2026-108018GHSA-jc8j-qq6m-2r53

Information disclosure in HCLSoftware BigFix MCM and Mobile

Priority LOW 27CWE-497Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-497.

Summary

HCLSoftware BigFix MCM & Mobile through 3.7 exposes environment details through a client-side configuration file. CWE-497 covers the exposure of system information to an unauthorized control sphere, here because the BigFix MCM admin portal is reachable from the internet without VPN or network restriction. A remote attacker with low privileges and user interaction gains access to these details, and the exposure raises the risk of unauthorized access attempts.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.  A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts.

Why it matters now

EPSS 0.00165 5th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HCL SoftwareBigFix MCM & Mobileup to 3.7—No fix listedCNA
  • BigFix MCM & Mobile VendorHCL Software Affected up to 3.7 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for BigFix MCM & Mobile.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-108018
  2. 2026-11-06 Alias added: GHSA-jc8j-qq6m-2r53
  3. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 1

  • TI-2023-24505 Path Traversal which allows file upload capability affects DRYiCE MyXalytics CVSS 3.1CRITICAL 9.8
  • TI-2022-22044 Out-of-bounds write in HCL Software Notes CVSS 3.1CRITICAL 9.8
  • TI-2022-22043 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
  • TI-2022-22042 Out-of-bounds write in HCL Software Notes CVSS 3.1CRITICAL 9.8
  • TI-2022-22041 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
  • TI-2022-22040 Out-of-bounds write in HCL Software Notes CVSS 3.1CRITICAL 9.8
See all 661 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences