# Hcltech vulnerabilities

Source: https://junglewise.ai/threats/vendors/hcltech  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/hcltech.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 54 vulnerabilities in Hcltech: 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2025-31974, was published on 6 May 2026. 8 technologies have a page of their own.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 54 (1 critical, 0 exploited in the wild)

## About Hcltech

HCL Technologies is a global information technology services and consulting company.

## Latest Hcltech vulnerabilities

- [CVE-2025-31974: HCL BigFix Service Management insecure root file system configuration](https://junglewise.ai/threats/cve-2025-31974-hcl-bigfix-service-management-insecure-root-file-system) (low, CVSS 3.9, published 6 May 2026)
- [CVE-2025-31960: HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its…](https://junglewise.ai/threats/cve-2025-31960-hcl-bigfix-service-management-sm-is-vulnerable-to-information) (medium, CVSS 5.3, published 6 May 2026)
- [CVE-2025-52613: HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an…](https://junglewise.ai/threats/cve-2025-52613-hcl-bigfix-service-management-sm-is-affected-by-use-of-a) (medium, CVSS 4.6, published 6 May 2026)
- [CVE-2025-31984: HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure…](https://junglewise.ai/threats/cve-2025-31984-hcl-bigfix-service-management-sm-is-affected-by-a-security) (low, CVSS 3.7, published 6 May 2026)
- [CVE-2025-31983: HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This…](https://junglewise.ai/threats/cve-2025-31983-hcl-bigfix-service-management-sm-is-affected-by-a-security) (low, CVSS 3.7, published 6 May 2026)
- [CVE-2025-31982: HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed…](https://junglewise.ai/threats/cve-2025-31982-hcl-bigfix-service-management-sm-had-directories-that-were-not) (low, CVSS 3.7, published 6 May 2026)
- [CVE-2025-31978: HCL BigFix Service Management CSV injection in spreadsheet exports](https://junglewise.ai/threats/cve-2025-31978-hcl-bigfix-service-management-csv-injection-in-spreadsheet) (medium, CVSS 4.6, published 6 May 2026)
- [CVE-2025-31976: HCL BigFix Service Management insufficiently protected credentials](https://junglewise.ai/threats/cve-2025-31976-hcl-bigfix-service-management-insufficiently-protected) (medium, CVSS 4.8, published 6 May 2026)
- [CVE-2025-31975: HCL BigFix Service Management (SM) is affected by an Information Disclosure , Server Banner issue was identified…](https://junglewise.ai/threats/cve-2025-31975-hcl-bigfix-service-management-sm-is-affected-by-an-information) (low, CVSS 2.6, published 6 May 2026)
- [CVE-2025-31959: HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to…](https://junglewise.ai/threats/cve-2025-31959-hcl-bigfix-service-management-sm-application-fails-to-strip-exif) (low, CVSS 3.5, published 6 May 2026)
- [CVE-2025-31957: HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead…](https://junglewise.ai/threats/cve-2025-31957-hhcl-bigfix-service-management-sm-is-affected-by-a-cross-site) (low, CVSS 2.6, published 6 May 2026)
- [CVE-2025-59854: HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes…](https://junglewise.ai/threats/cve-2025-59854-hcl-dfxanalytics-is-affected-by-an-insecure-security-header) (low, CVSS 3.1, published 6 May 2026)
- [CVE-2025-59853: HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack…](https://junglewise.ai/threats/cve-2025-59853-hcl-dfxanalytics-is-affected-by-an-improper-error-handling) (low, CVSS 3.1, published 6 May 2026)
- [CVE-2025-59852: HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted…](https://junglewise.ai/threats/cve-2025-59852-hcl-dfxanalytics-is-affected-by-an-insufficient-transport-layer) (low, CVSS 3.7, published 6 May 2026)
- [CVE-2025-59851: HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes…](https://junglewise.ai/threats/cve-2025-59851-hcl-dfxanalytics-is-affected-by-a-using-components-with-known) (low, CVSS 3.7, published 6 May 2026)
- [CVE-2025-31970: HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the…](https://junglewise.ai/threats/cve-2025-31970-hcl-dfxanalytics-is-affected-by-an-insecure-security-header) (medium, CVSS 5.3, published 6 May 2026)
- [CVE-2025-31981: HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open…](https://junglewise.ai/threats/cve-2025-31981-hcl-bigfix-service-management-sm-discovery-is-vulnerable-to) (medium, CVSS 5.3, published 21 Apr 2026)
- [CVE-2025-31958: HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise…](https://junglewise.ai/threats/cve-2025-31958-hcl-bigfix-service-management-is-susceptible-to-http-request) (low, CVSS 3.7, published 21 Apr 2026)
- [CVE-2025-52641: HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem…](https://junglewise.ai/threats/cve-2025-52641-hcl-aion-is-affected-by-a-vulnerability-where-certain-system) (low, CVSS 2.9, published 15 Apr 2026)
- [CVE-2025-31991: HCL DevOps Velocity improper rate limiting in login](https://junglewise.ai/threats/cve-2025-31991-hcl-devops-velocity-improper-rate-limiting-in-login) (medium, CVSS 6.8, published 13 Apr 2026)
- [CVE-2026-21767: HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive…](https://junglewise.ai/threats/cve-2026-21767-hcl-bigfix-platform-is-affected-by-insufficient-authentication) (medium, CVSS 4, published 2 Apr 2026)
- [CVE-2026-21765: HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys…](https://junglewise.ai/threats/cve-2026-21765-hcl-bigfix-platform-is-affected-by-insecure-permissions-on) (high, CVSS 8.8, published 2 Apr 2026)
- [CVE-2025-62320: HCL Unica HTML injection in web interface](https://junglewise.ai/threats/cve-2025-62320-hcl-unica-html-injection-in-web-interface) (medium, CVSS 4.7, published 17 Mar 2026)
- [CVE-2025-62319: HCL Unica blind SQL injection in backend configuration queries](https://junglewise.ai/threats/cve-2025-62319-hcl-unica-blind-sql-injection-in-backend-configuration-queries) (critical, CVSS 9.8, published 16 Mar 2026)
- [CVE-2025-31964: Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a…](https://junglewise.ai/threats/cve-2025-31964-improper-service-binding-configuration-in-internal-service) (low, CVSS 2.2, published 7 Jan 2026)

## Most severe Hcltech vulnerabilities

- [CVE-2025-62319: HCL Unica blind SQL injection in backend configuration queries](https://junglewise.ai/threats/cve-2025-62319-hcl-unica-blind-sql-injection-in-backend-configuration-queries) (critical, CVSS 9.8, published 16 Mar 2026)
- [CVE-2026-21765: HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys…](https://junglewise.ai/threats/cve-2026-21765-hcl-bigfix-platform-is-affected-by-insecure-permissions-on) (high, CVSS 8.8, published 2 Apr 2026)
- [CVE-2025-52650: Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0](https://junglewise.ai/threats/cve-2025-52650-inline-script-execution-allowed-in-csp-vulnerability-has-been) (high, CVSS 8.2, published 10 Oct 2025)
- [CVE-2025-52653: HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the…](https://junglewise.ai/threats/cve-2025-52653-hcl-myxalytics-product-is-affected-by-cross-site-scripting) (high, CVSS 7.6, published 3 Oct 2025)
- [CVE-2025-51735: CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.](https://junglewise.ai/threats/cve-2025-51735-csv-formula-injection-vulnerability-in-hcl-technologies-ltd-unica) (high, CVSS 7.5, published 28 Nov 2025)
- [CVE-2025-31991: HCL DevOps Velocity improper rate limiting in login](https://junglewise.ai/threats/cve-2025-31991-hcl-devops-velocity-improper-rate-limiting-in-login) (medium, CVSS 6.8, published 13 Apr 2026)
- [CVE-2025-0277: HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy…](https://junglewise.ai/threats/cve-2025-0277-hcl-bigfix-mobile-3-3-and-earlier-are-vulnerable-to-certain) (medium, CVSS 6.5, published 16 Oct 2025)
- [CVE-2025-0276: HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the…](https://junglewise.ai/threats/cve-2025-0276-hcl-bigfix-modern-client-management-mcm-3-3-and-earlier-are) (medium, CVSS 6.5, published 16 Oct 2025)
- [CVE-2025-52632: A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.](https://junglewise.ai/threats/cve-2025-52632-a-missing-secure-attribute-in-encrypted-session-ssl-cookie) (medium, CVSS 6.5, published 10 Oct 2025)
- [CVE-2025-51736: File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.](https://junglewise.ai/threats/cve-2025-51736-file-upload-vulnerability-in-hcl-technologies-ltd-unica-12-0-0) (medium, CVSS 6.3, published 28 Nov 2025)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Hcltech technologies

- [Hcltech Bigfix Service Management](https://junglewise.ai/threats/technologies/bigfix-service-management): 13 vulnerabilities
- [Hcltech Unica](https://junglewise.ai/threats/technologies/unica): 11 vulnerabilities
- [Hcltech Aion](https://junglewise.ai/threats/technologies/hcltech-aion): 8 vulnerabilities
- [Hcltech Dfxanalytics](https://junglewise.ai/threats/technologies/hcltech-dfxanalytics): 5 vulnerabilities
- [Hcltech Bigfix Modern Client Management](https://junglewise.ai/threats/technologies/bigfix-modern-client-management): 4 vulnerabilities
- [Hcltech Bigfix Mobile](https://junglewise.ai/threats/technologies/hcltech-bigfix-mobile): 4 vulnerabilities
- [Hcltech Bigfix Insights For Vulnerability Remediation](https://junglewise.ai/threats/technologies/bigfix-insights-for-vulnerability-remediation): 3 vulnerabilities
- [Hcltech Unica Centralized Offer Management](https://junglewise.ai/threats/technologies/unica-centralized-offer-management): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Hcltech vulnerabilities", https://junglewise.ai/threats/vendors/hcltech, 9 November 2026.