HTTP Request Smuggling occurs when a front‑end and back‑end server parse the same request differently, allowing an attacker to split or duplicate a request. In HCL BigFix Service Management, this flaw can let a malicious actor trick the system into ignoring request boundaries, potentially bypassing authentication or other security controls. The vulnerability is classified as CWE-444 and can lead to cache poisoning or request hijacking.

The product affected is HCLSoftware: BigFix Service Management (SM). No specific version information is provided, so the issue may be relevant to all installations of the product that employ the implicated HTTP request handling components.

The CVSS score of 3.7 indicates low severity, and the lack of an EPSS score suggests limited publicly known exploitation activity. It is not listed in the CISA KEV catalog. The attack requires crafting malicious HTTP requests and exploiting server parsing inconsistencies, meaning the threat surface is confined to environments that expose the SM web interface. Overall risk is moderate, mainly due to the potential to bypass controls even though the impact is limited by the low CVSS value.