---
id: CVE-2026-67101
title: >-
  HCL BigFix Service Management is affected by a Server-Side Request Forgery
  (SSRF) vulnerability in its search functionality, which could allow an
  attacker to force the application server to send requests to internal systems
  that are not …
summary: >-
  HCL BigFix Service Management is affected by a Server-Side Request Forgery
  (SSRF) vulnerability in its search functionality, which could allow an
  attacker to force the application server to send requests to internal systems
  that are not …
severity: critical
cvss: 9.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N'
cwe:
  - CWE-918
vendor: hcltech
product: bigfix_service_management
affected:
  - bigfix_service_management = 23
  - bigfix_service_management = 27
published: '2026-09-18'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T20:36:46.760'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67101'
references:
  - url: >-
      https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782
    label: psirt@hcl.com
tags:
  - nvd
  - cve.org
epss: 0.00258
epssPercentile: 0.1739
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T18:13:08.816315Z'
ingestedAt: '2026-09-18T08:38:04.103Z'
---

## Overview

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.

## Affected

- `bigfix_service_management = 23`
- `bigfix_service_management = 27`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.