HCL BigFix Service Management contains a stored XSS flaw that permits an attacker to inject malicious scripts that are permanently saved in the application. When a victim views the compromised page, the browser executes the injected code, which can hijack the user’s session and exfiltrate confidential data. The stored nature of the payload means the vulnerability persists until the application is updated or the data is removed.

The affected product is HCL BigFix Service Management. No specific product versions are listed in the advisory; therefore any installation of this product that has not yet received a vendor‑supplied update may be vulnerable.

The CVSS score of 7.2 indicates a high severity threat, though the EPSS value is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector involves submitting malicious input through a web form or other data‑entry interface that the application accepts without proper sanitization. Once the payload is stored, any user who accesses the affected page will be exposed, making the exploitation highly impactful when the attack surface is reachable.