CVE-2026-108013

HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)

View on CVE.org
Published Oct 24, 2026 CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Description
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.

Analysis

AI-generated

Technical impact

The vulnerability arises because BigFix Platform uses a Mozilla CA certificate bundle that, before 2026/10/20, continues to trust intermediate certificates whose private keys have already been compromised. When the platform validates HTTPS connections with such a bundle, an on‑path attacker can impersonate remote servers and tamper with files downloaded by the application, thereby compromising data integrity.

Affected Systems

HCL Software’s BigFix Platform is the only vendor identified as affected. Any installation that relies on a Mozilla CA certificate bundle dated before 2026/10/20 is vulnerable. The issue is resolved in BES Support version 1520 and later, which includes the updated bundle.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The flaw enables an on‑path attacker to impersonate servers and tamper with downloads, posing a significant risk to environments that depend on BigFix for critical updates.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to BES Support v1520 or later, which includes the corrected Mozilla CA bundle.
  • Replace any local copies of the Mozilla CA bundle with the version dated 2026/10/20 or newer.
  • Ensure BigFix Server and client configurations enforce strict SSL/TLS certificate verification and reject connections using compromised CA certificates.

Generated by OpenCVE AI on October 24, 2026 at 07:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Hcltech
Hcltech bigfix Platform
Vendors & Products Hcltech
Hcltech bigfix Platform
Type Values Removed Values Added
Weaknesses CWE-295
Type Values Removed Values Added
Description BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
Title HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}
Weaknesses
  • CWE-295

    Improper Certificate Validation

Sources

Status
PUBLISHED
Assigner
HCL
Published
Updated
Nov 2, 2026, 4:06 PM
Reserved
Oct 9, 2026, 9:26 AM

View source JSON

Updated
Nov 2, 2026, 4:06 PM

JSON

Status
Awaiting Analysis
Published
Oct 24, 2026, 7:16 AM
Modified
Nov 2, 2026, 4:17 PM

View source JSON

No data.

Updated
Oct 24, 2026, 7:45 AM

JSON