Insecure Certificate Validation in BigFix Platform by HCL Software
CVE-2026-108013

6.8MEDIUM

Key Information:

Vendor

HCL Software Software

Status
Bigfix Platform
Vendor
CVE Published:
24 October 2026

What is CVE-2026-108013?

The BigFix Platform leverages a Mozilla CA certificate bundle that, when versions are dated prior to October 20, 2026, still maintain trust in compromised certificates. This flaw enables an on-path attacker to impersonate remote servers and manipulate files that the application downloads. To mitigate this, ensure your bundle is updated to the version dated 2026/10/20 or later, available from BES Support v1520.

Affected Version(s)

BigFix Platform Platform 11.0.7 and below + 10.0.16 and below

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.