---
id: CVE-2026-67073
title: HCL BigFix AEX is affected by multiple security vulnerabilities.
summary: >-
  HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access
  Control vulnerability. This could allow an attacker to upload malicious or
  unauthorized files and directly access or download sensitive uploaded content,
  poten…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-434
  - CWE-79
  - CWE-552
  - CWE-284
vendor: HCL Software
product: BigFix AEX
affected:
  - bigfix_aex v13.0.0.1
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T12:24:30.101Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-67073'
references:
  - url: >-
      https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134281
tags:
  - cve.org
ingestedAt: '2026-10-28T13:11:23.685Z'
---

## Overview

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.

## Affected

- `bigfix_aex v13.0.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.