What’s Vulnerable › Vulnerabilities

CVE-2025-15633: HCL BigFix WebUI is affected by an improper authorization vulnerability

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-09 · updated 2026-07-25
• Weakness: CWE-863

Description

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

Affected products

• Hcltech Bigfix Webui Api: before 33 — fixed in 33
• Hcltech Bigfix Webui Application Administration: before 40 — fixed in 40
• Hcltech Bigfix Webui Cmep: before 22 — fixed in 22
• Hcltech Bigfix Webui Common: before 101 — fixed in 101
• Hcltech Bigfix Webui Content App: before 28 — fixed in 28
• Hcltech Bigfix Webui Custom: before 50 — fixed in 50
• Hcltech Bigfix Webui Data Sync: before 37 — fixed in 37
• Hcltech Bigfix Webui Extensions: before 14 — fixed in 14
• Hcltech Bigfix Webui Framework: before 35 — fixed in 35
• HCL Software HCL BigFix WebUI Insights: before 32 — fixed in 32
• Hcltech Bigfix Webui Ivr: before 23 — fixed in 23
• Hcltech Bigfix Webui Mdm: before 29 — fixed in 29
• Hcltech Bigfix Webui Patch: before 54 — fixed in 54
• Hcltech Bigfix Webui Patch Policies: before 51 — fixed in 51
• Hcltech Bigfix Webui Permissions And Preferences: before 27 — fixed in 27
• Hcltech Bigfix Webui Profile Management: before 33 — fixed in 33
• Hcltech Bigfix Webui Query: before 45 — fixed in 45
• Hcltech Bigfix Webui Reports: before 24 — fixed in 24
• Hcltech Bigfix Webui Scm: before 20 — fixed in 20
• Hcltech Bigfix Webui Software Distribution: before 54 — fixed in 54
• Hcltech Bigfix Webui Take Action: before 37 — fixed in 37

How to fix

Upgrade to a fixed version: Hcltech Bigfix Webui Api 33; Hcltech Bigfix Webui Application Administration 40; Hcltech Bigfix Webui Cmep 22; Hcltech Bigfix Webui Common 101; Hcltech Bigfix Webui Content App 28; Hcltech Bigfix Webui Custom 50; Hcltech Bigfix Webui Data Sync 37; Hcltech Bigfix Webui Extensions 14; Hcltech Bigfix Webui Framework 35; HCL Software HCL BigFix WebUI Insights 32; Hcltech Bigfix Webui Ivr 23; Hcltech Bigfix Webui Mdm 29. Check the vendor advisory for mitigations.

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130587

Get alerted when CVE-2025-15633 or the next vulnerability affects your stack