CVE-2026-21785

MediumCVSS 4.0/10Last modified Oct 26, 2026

Description

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
HCLSoftwareBigFix Remote Control Server<= versions 10.1.0.0442

References

Timeline

Published
May 27, 2026
Last modified
Oct 26, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-217863.3HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URCVE-2026-217885.4HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code inCVE-2026-217894.6HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2026-21797.2A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-userCVE-2026-217906.3HCL Traveler is susceptible to a weak default HTTP header validation vulnerability, which could allow an attacker to bypass additional autheCVE-2026-217913.3HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certaiCVE-2026-21808.8A vulnerability was identified in Tenda RX3 16.03.13.11. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manCVE-2026-218069.8HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneoCVE-2026-218073.9HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to causCVE-2026-218084.1HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakageCVE-2026-218093.9HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformCVE-2026-21818.8A security flaw has been discovered in Tenda RX3 16.03.13.11. Affected by this vulnerability is an unknown functionality of the file /goform
CVE-2026-21785: Medium severity, CVSS 4.0 | Vulnix