CVE-2026-21765

HighCVSS 7.8/10Last modified Oct 26, 2026

Description

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276 CWE-732

Affected software

Vendor	Product	Versions
HCLSoftware	BigFix Platform	11.0.0 - 11.0.5

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129906Vendor Advisory

Timeline

Published: Apr 2, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-217665.4The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very CVE-2026-217673.3HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the applicat CVE-2026-217686.3The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTM CVE-2026-21777.3A vulnerability has been found in SourceCodester Prison Management System 1.0. The impacted element is an unknown function of the component CVE-2026-217706.5HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace CVE-2026-21788.8A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb. This affects the function registerXco CVE-2026-217834.3HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed informati CVE-2026-217844.8HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's e CVE-2026-217854.0A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define d CVE-2026-217863.3HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain UR CVE-2026-217885.4HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in CVE-2026-217894.6HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.