Do Son 
HCL Technologies released security updates, addressing five severe HCL BigFix vulnerabilities. These critical software defects allow unauthenticated attackers to execute arbitrary database commands and force account password resets. System administrators must apply the newly released v27 hotfix immediately to protect corporate environments from unauthorized access.
- Total: 5 CVEs
- Severity: 3 Critical · 2 High
- Actively exploited: None confirmed
- Highest severity: 9.8 (Critical · CVSSv3) — CVE-2026-67100
- Action: Apply the latest security updates now
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsNotable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-67100 | 9.8 | is affected by multiple security . | — | Not exploited |
| CVE-2026-67101 | 9.3 | is affected by multiple security . | — | Not exploited |
| CVE-2026-18963 | 9.1 | CWE-640 | 26.4.15-1, 26.4-23, 26.6.6-1 (+4) | Not exploited |
| CVE-2026-67102 | 8.1 | is affected by multiple security . | — | Not exploited |
| CVE-2026-67103 | 7.6 | is affected by multiple security . | — | Not exploited |
Why This Threat Matters
Sourced estimates indicate that thousands of global enterprises use HCL BigFix Service Management for IT endpoint administration. Because this software handles critical identity management processes, these HCL BigFix vulnerabilities pose severe security risks. The most critical flaw, CVE-2026-67100, combines SQL Injection and Cross-Tenant Data Exposure. Attackers can exploit this defect to extract sensitive internal system details. The advisory notes attackers can “manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.”
How the Attacks Work
Another critical defect, CVE-2026-18963, targets the underlying Keycloak identity engine. The vendor states: “A flaw was found in the reset-credentials flow of the keycloak-services component.” An unauthenticated remote attacker can trigger password resets without requiring the target to click a verification link. Consequently, attackers can seize full control of targeted administrative accounts.
Additional bugs enable Server-Side Request Forgery (CVE-2026-67101), Cross-Site Scripting (CVE-2026-67103), and broken access controls (CVE-2026-67102). Currently, security researchers have confirmed no active in-the-wild exploitation for these vulnerabilities.
Affected Versions
These software defects impact HCL BigFix Service Management version 23 and version 27.
Patch and Mitigation Steps
Security teams must deploy the official vendor patch to secure their networks against remote intrusions. HCL resolved these flaws entirely within the unified v27 hotfix deployment. Organizations should review the HCL support bulletin for complete upgrade instructions. Administrators unable to patch immediately should restrict administrative access to secure internal networks.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
