Insufficiently Protected Credentials in HCL BigFix Service Management
CVE-2025-31976

4.8MEDIUM

Key Information:

Vendor

HCL Software Software

Status
Bigfix Service Management (sm)
Vendor
CVE Published:
6 May 2026

What is CVE-2025-31976?

HCL BigFix Service Management is affected by a vulnerability that allows for insufficiently protected credentials during communication with a backend application. This transient exposure could put those credentials at risk of exfiltration and misuse by an attacker, highlighting the need for robust credential protection mechanisms to safeguard against potential security incidents.

Affected Version(s)

BigFix Service Management (SM) 23

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.