CVE-2026-67100Patch(hcltech / bigfix_service_management)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch hcltech bigfix_service_management systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

hcltech CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782

Weakness type (CWE)

CWE-89CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

bigfix_service_management

Threat summary

Patch or workaround signal is available
3 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-09-18); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

hcltech

Products

bigfix_service_management

2 versions affected across 1 product

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Patch

266.7%

Disclosure

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-18	1	Patch1
2026-09-19	1	Patch1
2026-09-21	1	Disclosure1

Full discourse3 posts

Cybersecurity News DE@cybsecuritynews42d
Disclosure
#schwachstellen HCL BigFix Service Management: Kritische Schwachstellen erlauben SQL-Injection, SSRF und Mandanten-Datenzugriff #bigfixservicemanagement #cve202667100 #cve202667101 #hcl #sqlinjection #ssrf https://cybersecurity-news.de/hcl-bigfix-service-management-cve-2026-67100-cve-2026-67101
Post summary
The tweet discloses critical vulnerabilities in HCL BigFix Service Management, noting they enable SQL injection, SSRF, and tenant data access via CVE-2026-67100 and CVE-2026-67101, without mentioning exploits, patches, or active attacks.
0000040
13 followersView on X
NEXSIGHT@NEXSIGHTNEWS44d
Patch
HCL BigFix Service Managementに5件の脆弱性 — 最大CVSS 9.8のSQLインジェクションと組織をまたぐ個人情報参照、v27の修正プログラムで対応済み https://cyber.nexsight.co/articles/2026/09/19/hcl-bigfix-service-management-cve-2026-67100-critical-2026-09-19/
Post summary
The tweet announces five HCL BigFix Service Management vulnerabilities, highlights a critical 9.8 CVSS SQL injection, and notes remediation via a v27 patch.
0000048
74 followersView on X
Daily CyberSecurity@Daily_CyberSec45d
Patch
HCL Software patched critical HCL BigFix vulnerabilities, including CVE-2026-67100 and CVE-2026-18963. Patch now to prevent total account takeovers. #HCLBigFix #Cybersecurity #CVE202667100 #Vulnerability #InfoSec https://securityonline.info/hcl-bigfix-vulnerabilities-patched/
Post summary
HCL Software patched critical HCL BigFix vulnerabilities that could enable account takeovers. The post primarily urges users to apply the patch.
00000478
13.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	hcltech	bigfix_service_management	23	-	-
App	hcltech	bigfix_service_management	27	-	-

Explore more

Back to dashboard hcltech CVEs bigfix_service_management vulnerabilities