HCL BigFix Service Management is vulnerable to Cross‑Site Request Forgery. An attacker can cause a logged‑in user to perform privileged actions or expose sensitive data without the user’s knowledge. The vulnerability stems from missing CSRF protections on state‑changing operations (CWE‑352).

The affected product is HCL Software BigFix Service Management (SM). No specific version information is listed, so all currently deployed instances should be treated as potentially vulnerable until confirmed otherwise.

The CVSS score of 2.6 indicates a relatively low severity, and the issue is not listed in CISA's KEV catalog. Exploitation requires a user with valid credentials to inadvertently submit a malicious request; an attacker can provoke this by sending the victim a link or embedding a crafted form. Successful exploitation can lead to unauthorized data modifications or disclosure limited to the victim’s permission scope.