Description
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
Published: 2026-10-24
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: Server impersonation and file tampering via compromised intermediate CA certificate validation
Action: Patch
AI Analysis

Impact

The vulnerability arises because BigFix Platform uses a Mozilla CA certificate bundle that, before 2026/10/20, continues to trust intermediate certificates whose private keys have already been compromised. When the platform validates HTTPS connections with such a bundle, an on‑path attacker can impersonate remote servers and tamper with files downloaded by the application, thereby compromising data integrity.

Affected Systems

HCL Software’s BigFix Platform is the only vendor identified as affected. Any installation that relies on a Mozilla CA certificate bundle dated before 2026/10/20 is vulnerable. The issue is resolved in BES Support version 1520 and later, which includes the updated bundle.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw enables an on‑path attacker to impersonate servers and tamper with downloads, posing a significant risk to environments that depend on BigFix for critical updates.

Generated by OpenCVE AI on October 24, 2026 at 07:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to BES Support v1520 or later, which includes the corrected Mozilla CA bundle.
  • Replace any local copies of the Mozilla CA bundle with the version dated 2026/10/20 or newer.
  • Ensure BigFix Server and client configurations enforce strict SSL/TLS certificate verification and reject connections using compromised CA certificates.

Generated by OpenCVE AI on October 24, 2026 at 07:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-295

Sat, 24 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Description BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
Title HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: HCL

Published:

Updated: 2026-10-24T06:23:11.930Z

Reserved: 2026-10-09T09:26:54.337Z

Link: CVE-2026-108013

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-24T07:16:44.990

Modified: 2026-10-24T07:16:44.990

Link: CVE-2026-108013

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T07:30:10Z

Weaknesses
  • CWE-295

    Improper Certificate Validation