Executive brief
HCL BigFix Service Management is a configuration and lifecycle management platform used by enterprises to deploy and manage software across large IT environments. The product contains a file upload vulnerability that allows unauthenticated attackers to upload and execute malicious files, potentially compromising the entire server and enabling unauthorized access to managed systems and data.
Technical details
The vulnerability is an unrestricted file upload issue caused by improper file validation controls in HCL BigFix Service Management. The affected component fails to adequately validate uploaded file types and content, allowing an unauthenticated remote attacker to upload and execute arbitrary payloads. An attacker can exploit this to achieve remote code execution on the server. No authentication is required to exploit this vulnerability, making it highly accessible. Patches may be available through HCL support channels.
Affected products
- HCL BigFix Service Management
Timeline
- 2026-09-18: disclosed