SQL Injection and Cross-Tenant Data Exposure in HCL BigFix Service Management

CVE-2026-67100

What is CVE-2026-67100?

HCL BigFix Service Management is susceptible to SQL injection vulnerabilities, which enables authenticated attackers to execute arbitrary database commands and extract sensitive system information. Additionally, a Cross-Tenant Data Exposure flaw allows these attackers to manipulate request values, potentially leading to unauthorized access to sensitive personal profile data and personally identifiable information (PII) across multiple organizations. This raises significant security concerns for users relying on the platform's integrity and confidentiality.

References