CVE-2026-21785— HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy
Possible ATT&CK Techniques 1AI
T1505.003 · Web ShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HCLSoftware | BigFix Remote Control Server | <= versions 10.1.0.0442 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-21785
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy
Source: NVD (National Vulnerability Database)
Vulnerability Description
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
不当限制渲染UI层或帧
Source: NVD (National Vulnerability Database)
Vulnerability Title
HCL BigFix Remote Control Server WebUI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL BigFix Remote Control Server WebUI是印度HCL公司的一个用于远程管理和控制的Web用户界面。 HCL BigFix Remote Control Server WebUI 10.1.0.0442及之前版本存在安全漏洞，该漏洞源于内容安全策略配置错误，未能定义无回退的指令，可能导致攻击者绕过安全限制并加载未授权资源。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCLSoftware | BigFix Remote Control Server | <= versions 10.1.0.0442 | - |
II. Public POCs for CVE-2026-21785
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-21785
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-21785 (1)
IV. Related Vulnerabilities
Same vendor: HCLSoftware
- CVE-2026-21836
HCL DominoIQ is affected by broken access control - CVE-2026-21789
HCL Connections is vulnerable to broken access control - CVE-2026-21821
HCL BigFix SCM Reporting is affected by vulnerabilities in j - CVE-2025-15634
HCL BigFix WebUI is affected by a missing authorization vuln - CVE-2025-15633
HCL BigFix WebUI is affected by an improper authorization vu
Same weakness: CWE-1021
- CVE-2026-9396
Besen BS20 EV Charging Station Firmware Version Check ui lay - CVE-2025-62316
HCL AION is affected by a vulnerability where certain securi - CVE-2026-3254
Improper Restriction of Rendered UI Layers or Frames in GitL - CVE-2026-2378
Address bar spoofing risk in ArcSearch on Android - CVE-2025-62328
HCL Nomad server on Domino is affected by a missing default
V. Comments for CVE-2026-21785
No comments yet