Live › vulnerability › CVE-2026-21830
Go to dashboardHCL BigFix AEX ships a bundled aws-sdk package with a flaw that can cause AWS API requests to be sent to unintended or non-AWS endpoints. An attacker who can influence endpoint routing could receive request data, such as credentials or payloads, meant for AWS.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Teams running HCL BigFix AEX that uses the bundled aws-sdk to call AWS APIs. The sources do not describe which AEX configurations trigger the flaw, so exposure beyond that is unknown. Teams not running BigFix AEX can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.
This page as .md · .json · in your agent: get_signal("CVE-2026-21830")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.