HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
HCL BigFix Platform is affected because it uses an outdated Mozilla CA certificate bundle that still trusts certificates with compromised private keys. An attacker positioned between the application and a server could impersonate that server and tamper with files the application downloads.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- HCL Software BigFix Platform
Platform 11.0.7 and below + 10.0.16 and below