CVE-2026-67101CWE-918ssrf

CVE-2026-67101

Critical · published September 18, 2026

CVSS v3.1
9.3
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

The record
Technical detail
CVSS v3.1
9.3 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-18T12:17Z
Affected products (2)
ProductVersionsFixed in
hcltech/bigfix_service_managementall versions—
hcltech/bigfix_service_managementall versions—
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782 · [email protected]
EPSS history
Timeline
  • 19 SEP 03:53Z
    EPSS moved — → 0%
    epss
  • 18 SEP 07:50Z
    HCL BigFix Service Management is affected by multiple security vulnerabilities.
    cvelistv5