# CVE-2026-21808: HCL BigFix Quantum Risk Analyzer verbose logging information disclosure

Source: https://junglewise.ai/threats/cve-2026-21808-hcl-bigfix-quantum-risk-analyzer-verbose-logging-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-21808 · Severity: medium · CVSS 4.1 · Published 2026-08-26

HCL BigFix Quantum Risk Analyzer is a risk assessment and compliance management tool used to identify and manage security vulnerabilities across IT infrastructure. By default, the application generates highly detailed logs that expose sensitive information including internal application logic, architectural details, and potentially confidential business data—creating a significant risk if logs are accessed by unauthorized parties or attackers.

Technologies: [HCL BigFix Quantum Risk Analyzer](https://junglewise.ai/threats/technologies/bigfix-quantum-risk-analyzer). Vendors: [HCL](https://junglewise.ai/threats/vendors/hcl).

## Quick answers

**Is CVE-2026-21808 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21808 being exploited in the wild.

**How severe is CVE-2026-21808?** Medium severity, with a CVSS score of 4.1, published 26 August 2026.

**Which products and versions are affected?** HCL BigFix Quantum Risk Analyzer.

**Is there a fix for CVE-2026-21808?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-21808 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-21808?** Check whether you run HCL BigFix Quantum Risk Analyzer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an information disclosure issue caused by overly verbose logging enabled by default in HCL BigFix Quantum Risk Analyzer. The application logs sensitive details about its internal architecture, application logic, and operational data without adequate filtering or suppression. An attacker with access to logs (via misconfigured storage, unauthorized file access, or log aggregation systems) can extract architectural knowledge and sensitive information to facilitate further attacks. There are no preconditions for access beyond obtaining the log files themselves. Patches or configuration changes to disable verbose logging by default are expected to be available from HCL.

## Affected products

- HCL BigFix Quantum Risk Analyzer

## Timeline

- 2026-08-26: disclosed

## References

- [https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133289](https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133289)

## Related threats

- [HCL BigFix Quantum Risk Analyzer stack buffer overflow](https://junglewise.ai/threats/cve-2026-21807-hcl-bigfix-quantum-risk-analyzer-stack-buffer-overflow)
- [HCL BigFix Quantum Risk Analyzer hardcoded resource and binary integrity issues](https://junglewise.ai/threats/cve-2026-21810-hcl-bigfix-quantum-risk-analyzer-hardcoded-resource-and-binary)
- [HCL BigFix Quantum Risk Analyzer information disclosure in validation](https://junglewise.ai/threats/cve-2026-21809-hcl-bigfix-quantum-risk-analyzer-information-disclosure-in)