CVE-2026-56599

LowCVSS 2.2/10Last modified Oct 5, 2026

Description

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access.

Metrics

CVSS 3.1 2.2/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-614

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-56606.3A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown function of the file /CVE-2026-566085.3HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowin CVE-2026-566096.5HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions s CVE-2026-56615.3A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handler. Such manipulation CVE-2026-566195.4HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user CVE-2026-566204.3HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.CVE-2026-566237.1Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. CVE-2026-566247.3Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. CVE-2026-56639.8A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file CVE-2026-566428.8Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network.CVE-2026-566437.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-566447.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.