CVE-2026-108013

MediumCVSS 6.8/10Last modified Oct 24, 2026

Description

BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
HCL SoftwareBigFix PlatformPlatform 11.0.7 and below + 10.0.16 and below

References

Timeline

Published
Oct 24, 2026
Last modified
Oct 24, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-108024.3A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/srcCVE-2026-108033.6A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.CVE-2026-1080397.5By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large reqCVE-2026-108044.7A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashiCVE-2026-108056.7A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processinCVE-2026-108066.3A vulnerability was found in mjperpinosa stumasy. The affected element is an unknown function of the file application/PHP/objects/updates/adCVE-2026-1080626.9Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whCVE-2026-1080635.5A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongsiCVE-2026-1080646.5The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL cCVE-2026-1080659.8SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpoint in Channel Software WebAlliance eCommerce [VERSION — misCVE-2026-1080662.7The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authenticatiCVE-2026-1080695.3The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before a