HCL Software has 21 CVEs on record. Disclosure cadence is accelerating: 21 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 16. The median CVSS is 3.8 (low), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-20 (4). Most affected products: BigFix AEX (6), iControl (5), MyXalytics (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 3.8
- Publish → KEV
- —
- Last 90 days
- 21 prev 0
Weakness classes
Products
- BigFix AEX 6
- iControl 5
- MyXalytics 3
- AppScan Integration with Azure Boards for ASoC & A360 2
- AION 1
- BigFix Platform 1
Worst active — by depth score
CVE-2026-67074Critical· 9.1HCL BigFix AEX is affected by multiple security vulnerabilities.50CVE-2026-66246High· 8.8iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modific…48CVE-2026-67073High· 8.6HCL BigFix AEX is affected by multiple security vulnerabilities.47CVE-2026-108013Medium· 6.8HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)37CVE-2026-67080Medium· 6.5HCL BigFix AEX is affected by multiple security vulnerabilities.36
HCL Software vulnerabilities
CVEs affecting HCL Software, newest first. Open any entry for full detail, references, and exploit status.
21 CVEsRSS
CVE-2026-67074Critical· 9.1HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system…
CVE-2026-67080Medium· 6.5HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system de…
CVE-2026-67073High· 8.6HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, poten…
CVE-2026-67079Medium· 6.4HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthori…
CVE-2026-67077Medium· 4.2HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to uninte…
CVE-2026-21830Low· 3.7HCL BigFix AEX is affected by multiple security vulnerabilities.
HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.
CVE-2026-108013Medium· 6.8HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on…
CVE-2026-21812Low· 2.2Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or aut…
CVE-2026-21811Low· 3.8Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be expos…
CVE-2026-56596Low· 3.5HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended applicatio…
HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended applicatio…
CVE-2026-21833Low· 3.7HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured
HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles…
CVE-2026-66253Low· 3.1iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of …
iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of …
CVE-2026-66248Low· 3.1iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to p…
iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to p…
CVE-2026-66246High· 8.8iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modific…
iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modific…
CVE-2026-66247Medium· 4.3iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrat…
iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrat…
CVE-2026-66249Low· 3.1iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as ses…
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as ses…
CVE-2025-32000Medium· 4.3HCL Sametime is vulnerable to insufficient input sanitization
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage …
CVE-2026-21822Medium· 6.3HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component
HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially…
CVE-2025-52657Low· 3.5HCL MyXalytics was affected by Potential DOS Vulnerability
HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability.
CVE-2025-52652Low· 3.5HCL MyXalytics was affected by Content Spoofing Vulnerability
HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.
CVE-2025-52651Low· 3.5HCL MyXalytics was affected by Improper Input validation Vulnerability
HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.