---
id: CVE-2026-67100
title: >-
  HCL BigFix Service Management is affected by SQL Injection flaw and a
  Cross-Tenant Data Exposure flaw vulnerabilities
summary: >-
  HCL BigFix Service Management is affected by SQL Injection flaw and a
  Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an
  authenticated attacker to inject database commands to extract sensitive system
  details, as well a…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
  - CWE-200
vendor: hcltech
product: bigfix_service_management
affected:
  - bigfix_service_management = 23
  - bigfix_service_management = 27
published: '2026-09-18'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T20:37:08.437'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67100'
references:
  - url: >-
      https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782
    label: psirt@hcl.com
tags:
  - nvd
  - cve.org
epss: 0.00468
epssPercentile: 0.40345
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-18T17:31:31.736735Z'
ingestedAt: '2026-09-18T08:38:04.102Z'
---

## Overview

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

## Affected

- `bigfix_service_management = 23`
- `bigfix_service_management = 27`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.