{"id":"CVE-2026-108013","kind":"vulnerability","aliases":["CVE-2026-108013"],"related":[],"title":"BigFix Platform: outdated CA bundle trusts compromised certificates, enabling impersonation","description":"BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.","summary":"BigFix Platform ships a Mozilla CA certificate bundle dated before 2026/10/20 that still trusts certificates whose private keys were compromised. An on-path attacker can impersonate remote servers and tamper with files the application downloads.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bigfix","on-prem","self-hosted","vendor"],"not_affected_if":["bundle-2026-10-20-or-later"],"how_to_check":"- unknown","fix":"- Move to CA certificate bundle version `2026/10/20` or later, available starting from BES Support `v1520`.","status":"open","published_at":"2026-10-24T07:16:44+00:00","first_seen_at":"2026-10-24T08:17:08+00:00","triaged_at":"2026-10-25T03:42:34+00:00","updated_at":"2026-10-25T03:42:34+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:42:34Z","model":"claude-haiku-5-5","output":{"fix":"- Move to CA certificate bundle version `2026/10/20` or later, available starting from BES Support `v1520`.","reach":"network","title":"BigFix Platform: outdated CA bundle trusts compromised certificates, enabling impersonation","impact":"medium","summary":"BigFix Platform ships a Mozilla CA certificate bundle dated before 2026/10/20 that still trusts certificates whose private keys were compromised. An on-path attacker can impersonate remote servers and tamper with files the application downloads.","category":"vendor","nicknames":[],"who_cares":["bigfix","self-hosted","on-prem"],"confidence":0.6,"needs_auth":"no","worst_case":"on-path attacker impersonates servers and tampers with downloaded files","analyst_note":"Confirm the exact BES Support or BigFix Platform versions affected and the procedure to update the bundle; check the vendor advisory (IBM) linked from NVD.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["bundle-2026-10-20-or-later"],"who_is_affected":"BigFix Platform deployments using a CA certificate bundle dated before 2026/10/20 are exposed when they validate remote servers. An attacker must sit on the network path between the server and the remote host to exploit it. Installations already on BES Support v1520 or later with the updated bundle are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000595,"input_tokens":3363,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108013':13A,16A '-2026':12A,15A '2026/10/20':35B,75C,119C 'applic':59B,110C 'attack':49B,98C 'avail':126C 'bes':129C 'bigfix':1A,17B,25B,61C,86C 'bundl':5A,32B,67C,72C,93C,117C,124C 'ca':4A,30B,65C 'certif':8A,31B,39B,66C,78C 'compromis':7A,44B,84C 'cve':11A,14A 'date':33B,73C 'download':60B,107C 'enabl':9A 'file':57B,106C 'fix':123C 'host':23B 'imperson':10A,51B,100C 'issu':112C 'key':42B,81C 'later':121C 'mozilla':29B,64C 'on-path':46B,95C 'on-prem':18B 'outdat':3A 'path':48B,97C 'pem':68C 'platform':2A,26B,62C,87C 'prem':20B 'privat':41B,80C 'remot':52B,101C 'resolv':114C 'self':22B 'self-host':21B 'server':53B,89C,102C 'ship':27B 'start':127C 'still':37B,76C 'support':130C 'tamper':55B,104C 'trust':6A,38B,77C 'use':63C,90C,116C 'v1520':131C 'valid':88C 'vendor':24B 'version':69C,118C 'whose':40B,79C","nicknames":[],"mitigations":[],"who_affected":"BigFix Platform deployments using a CA certificate bundle dated before 2026/10/20 are exposed when they validate remote servers. An attacker must sit on the network path between the server and the remote host to exploit it. Installations already on BES Support v1520 or later with the updated bundle are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T07:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108013","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108013","severity":null,"published_at":"2026-10-24T07:16:44+00:00","modified_at":"2026-10-24T07:16:44+00:00","first_seen_at":"2026-10-24T08:17:08+00:00","fetched_at":"2026-10-24T08:17:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}