HCL BigFix Multiple Vulnerabilities Remote Attack CVSS 5.3

CERT-Bund published advisory WID-SEC-2026-1186 disclosing multiple security vulnerabilities in HCL BigFix Service Management software. The vulnerabilities affect versions prior to 26.0 and prior to 27 across Linux, UNIX, and Windows platforms. With a CVSS Base Score of 5.3 (medium) and confirmed remote attack capability, organisations using this endpoint management solution should assess their exposure. The advisory notes that mitigations are available.

Affected parties running HCL BigFix Service Management in enterprise environments should verify their current version against the thresholds stated, evaluate compensating controls, and apply available patches or workarounds. The advisory originates from CERT-Bund, Germany's federal computer emergency response team operating under the Federal Office for Information Security (BSI).