CVE-2026-108013— HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
Quick assessment
Affected
HCL Software BigFix Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
BigFix 平台使用 Mozilla CA 证书捆绑包（PEM 格式）。2026 年 10 月 20 日之前发布的捆绑包版本，仍信任那些私钥已被泄露的证书。当 BigFix 平台使用此类捆绑包验证服务器时，处于中间位置的攻击者能够冒充远程服务器，并篡改应用程序下载的文件。该问题可通过使用 2026 年 10 月 20 日或之后版本的证书捆绑包来解决。修复后的捆绑包自 BES Support v1520 起提供。
Possible ATT&CK Techniques 2 AI
T1567 · Exfiltration Over Web Service T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108013
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
Source: CVE Program / CVE List V5
Vulnerability Description
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCL Software | BigFix Platform | Platform 11.0.7 and below + 10.0.16 and below | - |
|
II. Public POCs for CVE-2026-108013
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108013
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-108013 (1)
IV. Related Vulnerabilities
Same product: BigFix Platform
-
CVE-2026-21767
HCL BigFix Platform is affected by insufficient authenticati -
CVE-2026-21765
HCL BigFix Platform is affected by insecure permissions on p -
CVE-2024-30117
HCL BigFix Platform is affected by a DLL Hijack vulnerabilit -
CVE-2024-23556
HCL BigFix Platform is impacted by a failure to restrict SSL -
CVE-2024-23554
HCL BigFix Platform is susceptible to Cross-Site Request For
Same vendor: HCL Software
-
CVE-2026-21812
Multiple security vulnerabilities affect HCL AppScan Azure B -
CVE-2026-21811
Multiple security vulnerabilities affect HCL AppScan Azure B -
CVE-2026-56596
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-21833
HCL AION is susceptible to a Missing "Content-Security-Polic -
CVE-2025-31980
HCL BigFix Service Management is affected by multiple securi
V. Comments for CVE-2026-108013
No comments yet