CVE-2026-56595: hcl software hcl bigfix service management

Vulnerability summary

CVE-2026-56595 is a medium (CVSS 4.3) vulnerability in hcl software hcl bigfix service management. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.7% of scored vulnerabilities.

Timeline

1. 18-09-2026
   PublishedVulnerability first disclosed.
2. 18-09-2026
   Last modifiedVulnerability information updated.

Description

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.

• CWE-942Permissive Cross-domain Security Policy with Untrusted DomainsThe product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.