What’s Vulnerable › Vulnerabilities
CVE-2025-31978: HCL BigFix Service Management (SM) does not adequately sanitize or safely render
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-06 · updated 2026-10-07
- Weakness: CWE-201
Description
HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content.
Affected products
References
Get alerted when CVE-2025-31978 or the next vulnerability affects your stack