CVE-2026-67100CWE-200CWE-89sql-injectioninformation-disclosure

CVE-2026-67100

Critical · published September 18, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00468 · 39.6th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-09-18T12:17Z
Affected products (2)
ProductVersionsFixed in
hcltech/bigfix_service_managementall versions—
hcltech/bigfix_service_managementall versions—
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782 · [email protected]
EPSS history
Timeline
  • 19 SEP 03:53Z
    EPSS moved — → 0%
    epss
  • 18 SEP 07:53Z
    HCL BigFix Service Management is affected by multiple security vulnerabilities.
    cvelistv5