{"id":"CVE-2026-108018","title":"BigFix Mobile is affected by sensitive information disclosure","summary":"The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.  A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases th…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N","cvssSource":"cna","cwe":["CWE-497"],"vendor":"HCLSoftware","product":"BigFix MCM & Mobile","affected":["bigfix_mcm_mobile <= 3.7"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T08:27:09.873Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-108018","references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135001"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T08:48:01.703Z","epss":0.00165,"epssPercentile":0.05735,"slug":"CVE-2026-108018","body":"## Overview\n\nThe BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.  A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts.\n\n## Affected\n\n- `bigfix_mcm_mobile <= 3.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}