Live › vulnerability › CVE-2026-108013
Go to dashboardBigFix Platform ships a Mozilla CA certificate bundle dated before 2026/10/20 that still trusts certificates whose private keys were compromised. An on-path attacker can impersonate remote servers and tamper with files the application downloads.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 08:17 UTC. All times on this page are UTC.
BigFix Platform deployments using a CA certificate bundle dated before 2026/10/20 are exposed when they validate remote servers. An attacker must sit on the network path between the server and the remote host to exploit it. Installations already on BES Support v1520 or later with the updated bundle are not affected.
No product ranges from the sources yet.
2026/10/20 or later, available starting from BES Support v1520.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
This page as .md · .json · in your agent: get_signal("CVE-2026-108013")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.