CVE-2025-31976

HighCVSS 7.5/10Last modified Oct 7, 2026

Description

HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. .

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200 CWE-522

Affected software

Vendor	Product	Versions
HCL Software	BigFix Service Management (SM)	23

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144Vendor Advisory

Timeline

Published: May 6, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-319776.5HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could ex CVE-2025-319784.3HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or dis CVE-2025-319795.4A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce file CVE-2025-31985.5A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function displ CVE-2025-319804.3HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated CVE-2025-319815.3HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted a CVE-2025-319826.5HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow CVE-2025-319834.6HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers t CVE-2025-319845.4HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. CVE-2025-319856.5HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. CVE-2025-319877.5HCL Connections Docs may mishandle validation of certain uploaded documents leading to denial of service due to resource exhaustion.CVE-2025-319884.8HCL Digital Experience is susceptible to cross site scripting (XSS) in an administrative UI with restricted access.