---
id: CVE-2026-56590
title: >-
  HCL BigFix Service Management is affected by an Unrestricted File Upload
  vulnerability due to improper file validation controls, which could allow an
  unauthenticated attacker to upload and execute malicious payloads, resulting
  in a compl…
summary: >-
  HCL BigFix Service Management is affected by an Unrestricted File Upload
  vulnerability due to improper file validation controls, which could allow an
  unauthenticated attacker to upload and execute malicious payloads, resulting
  in a compl…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-434
vendor: hcltech
product: bigfix_service_management
affected:
  - bigfix_service_management = 23
  - bigfix_service_management = 27
published: '2026-09-18'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T17:56:59.173'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56590'
references:
  - url: >-
      https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133917
    label: psirt@hcl.com
tags:
  - nvd
  - cve.org
epss: 0.00193
epssPercentile: 0.08869
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T19:11:36.026646Z'
ingestedAt: '2026-09-18T08:38:04.115Z'
---

## Overview

HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.

## Affected

- `bigfix_service_management = 23`
- `bigfix_service_management = 27`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.