What’s Vulnerable › Vulnerabilities

CVE-2026-21785: HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy

• Severity: medium (CVSS 4.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-27 · updated 2026-10-26
• Weakness: CWE-1021

Description

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.

Affected products

• HCLSoftware BigFix Remote Control Server: through versions 10.1.0.0442

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130581

Get alerted when CVE-2026-21785 or the next vulnerability affects your stack