---
id: CVE-2026-67171
title: >-
  HCL BigFix Service Management is affected by an Information Disclosure
  vulnerability because an exposed API endpoint exposes sensitive internal
  database information
summary: >-
  HCL BigFix Service Management is affected by an Information Disclosure
  vulnerability because an exposed API endpoint exposes sensitive internal
  database information. This information could enable an attacker to facilitate
  targeted databa…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
  - CWE-209
vendor: hcltech
product: bigfix_service_management
affected:
  - bigfix_service_management = 27
published: '2026-10-01'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T16:46:37.400'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67171'
references:
  - url: >-
      https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134015
    label: psirt@hcl.com
tags:
  - nvd
  - cve.org
epss: 0.0024
epssPercentile: 0.15046
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-01T16:31:58.726534Z'
ingestedAt: '2026-10-01T18:55:42.364Z'
---

## Overview

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks.

## Affected

- `bigfix_service_management = 27`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.