CVE-2026-108013Medium· 6.8▾ SunlitBigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
bigfix_platform Platform 11.0.7 and below + 10.0.16 and belowRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67074Critical· 9.1HCL BigFix AEX is affected by multiple security vulnerabilities.
CVE-2026-67080Medium· 6.5HCL BigFix AEX is affected by multiple security vulnerabilities.
CVE-2026-67073High· 8.6HCL BigFix AEX is affected by multiple security vulnerabilities.
CVE-2026-67079Medium· 6.4HCL BigFix AEX is affected by multiple security vulnerabilities.
CVE-2026-67077Medium· 4.2HCL BigFix AEX is affected by multiple security vulnerabilities.
CVE-2026-21830Low· 3.7HCL BigFix AEX is affected by multiple security vulnerabilities.