CVE-2026-67100

CRITICALCVSS 9.8

Description

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

Timeline

Published:September 18th, 2026 8:17 AM

Last modified:September 18th, 2026 6:17 PM

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89 CWE-200

References & Reports

Advisories, patches, and third-party reports

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782

Source: NIST NVD · Data may lag official sources by up to one minute