Cross-Site Scripting Vulnerability in HCL Software MDM App Catalog
CVE-2026-65022

6.3MEDIUM

Key Information:

Vendor

HCL Softwaresoftware

Status
Bigfix Mcm & Mobile
Vendor
CVE Published:
6 November 2026

What is CVE-2026-65022?

The MDM App Catalog and App Store preview fail to adequately sanitize or encode user-supplied HTML. This oversight allows for the potential display of injected HTML to users viewing the preview. If a user interacts with this crafted content, it may lead to cross-site scripting (XSS) attacks, compromising the integrity and security of user data.

Affected Version(s)

BigFix MCM & Mobile <= 3.7

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.