CVE-2026-108013
HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
| Vendor | hcl software |
| Product | bigfix platform |
| Published | Oct 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for hcl software bigfix platform
Be the first to know when new medium vulnerabilities affecting hcl software bigfix platform are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
HCL Software / BigFix Platform
Platform 11.0.7 and below + 10.0.16 and below