CVE-2026-67074 PUBLISHED

HCL BigFix AEX is affected by multiple security vulnerabilities.

Assigner: HCL
Reserved: 28.07.2026 Published: 28.10.2026 Updated: 28.10.2026

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	HCL Software
Product	BigFix AEX
Versions	Default: unaffected Version v13.0.0.1 is affected

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134281

Problem Types

CWE-94 Improper Control of Generation of Code ('Code Injection') CWE
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE