HCL BigFix AEX suffers a Remote Code Execution vulnerability that allows an attacker to run arbitrary code with application or service privileges. The flaw permits unauthorized access, data exposure, or full system compromise. The underlying weaknesses are identified as OS Command Injection (CWE‑78) and Improper Code Injection/Execution (CWE‑94).

The affected product is HCL BigFix AEX. Specific version information is not supplied in the advisory.

The vulnerability carries a CVSS 9.1 score, placing it in the high severity category. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified, but the high CVSS score and lack of KEV listing suggest significant awareness by the community. Admission of remote code execution implies the attack vector is remote, likely through an interface that accepts untrusted input or an administrative configuration. No additional exploitation prerequisites are detailed, so an attacker with network access to the affected system could potentially exploit the flaw.