{"schemaVersion":1,"id":"CVE-2026-56590","requestedId":"CVE-2026-56590","aliases":[],"status":"published","rawState":"Analyzed","rawSeverityStatus":"Analyzed","duplicateOf":null,"indexable":true,"title":null,"description":"HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.","dates":{"published":"2026-09-18T08:22:16.082Z","modified":"2026-09-18T19:11:46.353Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"cve.org","score":6.4,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"nvd","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00285,"percentile":0.19529,"severity":"low","asOf":"2026-10-14T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-18T00:00:00.000Z","score":0.0017,"percentile":0.06796},{"date":"2026-09-19T00:00:00.000Z","score":0.0017,"percentile":0.06814},{"date":"2026-09-20T00:00:00.000Z","score":0.0017,"percentile":0.06805},{"date":"2026-09-21T00:00:00.000Z","score":0.0017,"percentile":0.06778},{"date":"2026-09-22T00:00:00.000Z","score":0.0017,"percentile":0.0679},{"date":"2026-09-23T00:00:00.000Z","score":0.0017,"percentile":0.06784},{"date":"2026-09-24T00:00:00.000Z","score":0.00285,"percentile":0.18634},{"date":"2026-09-25T00:00:00.000Z","score":0.00285,"percentile":0.18712},{"date":"2026-09-26T00:00:00.000Z","score":0.00285,"percentile":0.1881},{"date":"2026-09-27T00:00:00.000Z","score":0.00285,"percentile":0.18823},{"date":"2026-09-28T00:00:00.000Z","score":0.00285,"percentile":0.18827},{"date":"2026-09-29T00:00:00.000Z","score":0.00285,"percentile":0.18848},{"date":"2026-09-30T00:00:00.000Z","score":0.00285,"percentile":0.18931},{"date":"2026-10-01T00:00:00.000Z","score":0.00285,"percentile":0.18959},{"date":"2026-10-02T00:00:00.000Z","score":0.00285,"percentile":0.19031},{"date":"2026-10-03T00:00:00.000Z","score":0.00285,"percentile":0.19053},{"date":"2026-10-04T00:00:00.000Z","score":0.00285,"percentile":0.19043},{"date":"2026-10-05T00:00:00.000Z","score":0.00285,"percentile":0.19056},{"date":"2026-10-06T00:00:00.000Z","score":0.00285,"percentile":0.19147},{"date":"2026-10-07T00:00:00.000Z","score":0.00285,"percentile":0.19206},{"date":"2026-10-08T00:00:00.000Z","score":0.00285,"percentile":0.19225},{"date":"2026-10-09T00:00:00.000Z","score":0.00285,"percentile":0.19262},{"date":"2026-10-10T00:00:00.000Z","score":0.00285,"percentile":0.19297},{"date":"2026-10-11T00:00:00.000Z","score":0.00285,"percentile":0.19338},{"date":"2026-10-12T00:00:00.000Z","score":0.00285,"percentile":0.19355},{"date":"2026-10-13T00:00:00.000Z","score":0.00285,"percentile":0.19436},{"date":"2026-10-14T00:00:00.000Z","score":0.00285,"percentile":0.19529}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.0017,"percentile":0.06796},{"date":"2026-09-19T00:00:00.000Z","score":0.0017,"percentile":0.06814},{"date":"2026-09-20T00:00:00.000Z","score":0.0017,"percentile":0.06805},{"date":"2026-09-21T00:00:00.000Z","score":0.0017,"percentile":0.06778},{"date":"2026-09-22T00:00:00.000Z","score":0.0017,"percentile":0.0679},{"date":"2026-09-23T00:00:00.000Z","score":0.0017,"percentile":0.06784},{"date":"2026-09-24T00:00:00.000Z","score":0.00285,"percentile":0.18634},{"date":"2026-09-25T00:00:00.000Z","score":0.00285,"percentile":0.18712},{"date":"2026-09-26T00:00:00.000Z","score":0.00285,"percentile":0.1881},{"date":"2026-09-27T00:00:00.000Z","score":0.00285,"percentile":0.18823},{"date":"2026-09-28T00:00:00.000Z","score":0.00285,"percentile":0.18827},{"date":"2026-09-29T00:00:00.000Z","score":0.00285,"percentile":0.18848},{"date":"2026-09-30T00:00:00.000Z","score":0.00285,"percentile":0.18931},{"date":"2026-10-01T00:00:00.000Z","score":0.00285,"percentile":0.18959},{"date":"2026-10-02T00:00:00.000Z","score":0.00285,"percentile":0.19031},{"date":"2026-10-03T00:00:00.000Z","score":0.00285,"percentile":0.19053},{"date":"2026-10-04T00:00:00.000Z","score":0.00285,"percentile":0.19043},{"date":"2026-10-05T00:00:00.000Z","score":0.00285,"percentile":0.19056},{"date":"2026-10-06T00:00:00.000Z","score":0.00285,"percentile":0.19147},{"date":"2026-10-07T00:00:00.000Z","score":0.00285,"percentile":0.19206},{"date":"2026-10-08T00:00:00.000Z","score":0.00285,"percentile":0.19225},{"date":"2026-10-09T00:00:00.000Z","score":0.00285,"percentile":0.19262},{"date":"2026-10-10T00:00:00.000Z","score":0.00285,"percentile":0.19297},{"date":"2026-10-11T00:00:00.000Z","score":0.00285,"percentile":0.19338},{"date":"2026-10-12T00:00:00.000Z","score":0.00285,"percentile":0.19355},{"date":"2026-10-13T00:00:00.000Z","score":0.00285,"percentile":0.19436},{"date":"2026-10-14T00:00:00.000Z","score":0.00285,"percentile":0.19529}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","evidence":[]},"exploits":[],"exploitCount":0,"exploitSources":[],"weaknesses":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type","description":"The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/434.html","capec":[{"id":"CAPEC-1","name":"Accessing Functionality Not Properly Constrained by ACLs","url":"https://capec.mitre.org/data/definitions/1.html"}],"techniques":[{"id":"T1574.010","name":"Services File Permissions Weakness","url":"https://attack.mitre.org/techniques/T1574/010/","tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}]}],"countermeasures":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"},{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"},{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}]}],"ttp":{"capecs":[{"id":"CAPEC-1","name":"Accessing Functionality Not Properly Constrained by ACLs","url":"https://capec.mitre.org/data/definitions/1.html","weaknessIds":["CWE-434"],"techniqueIds":["T1574.010"]}],"techniques":[{"id":"T1574.010","name":"Services File Permissions Weakness","url":"https://attack.mitre.org/techniques/T1574/010/","weaknessIds":["CWE-434"],"capecIds":["CAPEC-1"],"tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}],"countermeasures":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"},{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"},{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}]}],"countermeasures":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"},{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"},{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}],"countermeasuresByTactic":[{"tactic":"Harden","items":[{"id":"D3-SU","name":"Software Update","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-SU/"}]},{"tactic":"Detect","items":[{"id":"D3-SBV","name":"Service Binary Verification","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SBV/"}]},{"tactic":"Restore","items":[{"id":"D3-RS","name":"Restore Software","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RS/"}]},{"tactic":"Model","items":[{"id":"D3-AVE","name":"Asset Vulnerability Enumeration","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-AVE/"},{"id":"D3-SWI","name":"Software Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-SWI/"}]}]},"affected":[{"vendor":"hcl software","product":"hcl bigfix service management","name":"HCL BigFix Service Management","label":"hcl bigfix service management","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"v27","noFixRecorded":false,"fixedIn":null}],"versionsText":"v27","eol":null},{"vendor":"hcltech","product":"bigfix_service_management","name":"bigfix service management","label":"bigfix_service_management","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"source":null,"versions":[{"text":"23","noFixRecorded":false,"fixedIn":null},{"text":"27","noFixRecorded":false,"fixedIn":null}],"versionsText":"23 | 27","eol":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133917","label":"support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133917","hostname":"support.hcl-software.com","tags":["Vendor Advisory"],"sources":["cve.org","nvd"]}],"droppedReferenceCount":0,"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-18T08:22:16.082Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-18T19:11:46.353Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"default","profileName":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10},"appliedRules":["high-cvss-alone"]},"warnings":[],"meta":{"dataAsOf":"2026-10-14T20:32:45.932Z","stale":false,"partial":false}}