What’s Vulnerable › Vulnerabilities

CVE-2025-15634: HCL BigFix WebUI is affected by a missing authorization vulnerability

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-09 · updated 2026-07-25
• Weakness: CWE-862

Description

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.

Affected products

• Hcltech Bigfix Webui Api: before 33 — fixed in 33
• Hcltech Bigfix Webui Application Administration: before 40 — fixed in 40
• Hcltech Bigfix Webui Cmep: before 22 — fixed in 22
• Hcltech Bigfix Webui Common: before 101 — fixed in 101
• Hcltech Bigfix Webui Content App: before 28 — fixed in 28
• Hcltech Bigfix Webui Custom: before 50 — fixed in 50
• Hcltech Bigfix Webui Data Sync: before 37 — fixed in 37
• Hcltech Bigfix Webui Extensions: before 14 — fixed in 14
• Hcltech Bigfix Webui Framework: before 35 — fixed in 35
• HCL Software HCL BigFix WebUI Insights: before 32 — fixed in 32
• Hcltech Bigfix Webui Ivr: before 23 — fixed in 23
• Hcltech Bigfix Webui Mdm: before 29 — fixed in 29
• Hcltech Bigfix Webui Patch: before 54 — fixed in 54
• Hcltech Bigfix Webui Patch Policies: before 51 — fixed in 51
• Hcltech Bigfix Webui Permissions And Preferences: before 27 — fixed in 27
• Hcltech Bigfix Webui Profile Management: before 33 — fixed in 33
• Hcltech Bigfix Webui Query: before 45 — fixed in 45
• Hcltech Bigfix Webui Reports: before 24 — fixed in 24
• Hcltech Bigfix Webui Scm: before 20 — fixed in 20
• Hcltech Bigfix Webui Software Distribution: before 54 — fixed in 54
• Hcltech Bigfix Webui Take Action: before 37 — fixed in 37

How to fix

Upgrade to a fixed version: Hcltech Bigfix Webui Api 33; Hcltech Bigfix Webui Application Administration 40; Hcltech Bigfix Webui Cmep 22; Hcltech Bigfix Webui Common 101; Hcltech Bigfix Webui Content App 28; Hcltech Bigfix Webui Custom 50; Hcltech Bigfix Webui Data Sync 37; Hcltech Bigfix Webui Extensions 14; Hcltech Bigfix Webui Framework 35; HCL Software HCL BigFix WebUI Insights 32; Hcltech Bigfix Webui Ivr 23; Hcltech Bigfix Webui Mdm 29. Check the vendor advisory for mitigations.

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130587

Get alerted when CVE-2025-15634 or the next vulnerability affects your stack