HCL BigFix flaws expose tenant data and admin accounts

HCL Technologies has released security updates for five vulnerabilities in HCL BigFix Service Management, affecting versions 23 and 27. The flaws comprise three critical and two high-severity issues, with the highest-rated, CVE-2026-67100, scoring 9.8 on CVSS v3. HCL BigFix is used for IT endpoint administration, and the vulnerabilities could enable unauthenticated attackers to execute database commands, access data across organisational tenants or take over administrative accounts. No active exploitation has been confirmed.

CVE-2026-67100 involves SQL injection and cross-tenant data exposure, potentially allowing attackers to obtain personal profile information and other personally identifiable information. CVE-2026-18963 affects the Keycloak identity engine’s credentials-reset process, allowing an unauthenticated remote attacker to trigger a password reset without the victim clicking a verification link.

The remaining vulnerabilities involve server-side request forgery (CVE-2026-67101), broken access controls (CVE-2026-67102) and cross-site scripting (CVE-2026-67103).

HCL says all five issues are addressed through the unified v27 hotfix deployment. Administrators should consult the vendor’s support bulletin for upgrade instructions and apply the update promptly. The source advises organisations unable to patch immediately to restrict administrative access to trusted internal networks. It lists fixes for CVE-2026-18963 in versions 26.4.15-1, 26.4-23 and 26.6.6-1, among others, but does not provide fixed-version details for the other four CVEs.