HCL BigFix Service Management carries an insecure cookie attribute configuration flaw. The application does not set critical cookie flags—SameSite, HttpOnly, Secure, or restrictive Path—so session cookies are vulnerable. An attacker can forge authenticated requests, hijack established sessions, or inject scripts via cross-site scripting, thereby gaining unauthorized access to privileged actions or data.

The flaw is present in HCL Software’s BigFix Service Management product. No specific versions are enumerated in the advisory, meaning that all deployments that have not applied the issued fix may be susceptible. Administrators should audit their environments and apply the vendor-supplied update.

The CVSS base score of 2.2 indicates a low overall severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, so it is not a known exploited issue. The likely attack vector is remote through the web interface; an attacker who can cause a victim’s browser to send unsanitized requests could leverage the missing cookie protections to perform CSRF or session hijacking without elevated privileges. The lack of enforced path restrictions also increases the scope though still limited to authenticated sessions. Consequently, the exploitation pathway is straightforward for a distant threat actor who can orchestrate cross-site traffic against a target.