HCL BigFix Service Management (SM) is vulnerable to a security misconfiguration due to a missing or insecure "X-Content-Type-Options" header. When this header is absent, browsers may perform MIME-type sniffing, causing malicious content to be interpreted and executed incorrectly. The weakness falls under CWE‑200 which relates to information disclosure and can lead to unintended code execution within the browser context.

This issue affects HCL BigFix Service Management (SM). No specific product versions are listed in the data, so any installation of BigFix SM could be impacted until the header configuration is corrected.

The CVSS score of 3.7 indicates a low severity risk; exploitation requires a web client that accesses content from the vulnerable service, implying that an attacker must trick a user into visiting malicious content. The EPSS score of <1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA KEV.