CVE-2026-67073

High

Description

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.

SeverityHigh

CVSS8.6

Exploit probability13. percentile0.2%

ProductBigFix AEX

PublishedOct 28, 2026

First seenNov 6, 2026

Weakness typeCWE-79Cross-site scripting (XSS)CWE-284Improper access control CWE-434Unrestricted upload of dangerous file type CWE-552CWE-552

How to fix

Sources list no fixed version or patch link for this vulnerability.

Affected products

Product	Affected versions	Fixed in
HCL Software BigFix AEX	v13.0.0.1	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.