Live › vulnerability › CVE-2026-67073
Go to dashboardHCL BigFix AEX has an unrestricted file upload flaw combined with improper access control. An attacker can upload unauthorized files and directly access or download sensitive uploaded content, which can lead to information disclosure or system compromise.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 13:33 UTC. All times on this page are UTC.
Anyone running a self-hosted (on-premises) HCL BigFix AEX v13.0.0.1 agentic AI platform. The CVSS vector says the file upload endpoint needs no login and is reachable over the network, so an instance exposed beyond the internal network is the main concern. Teams not running AEX can skip it. The bulletin does not say whether the SaaS service is affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| BigFix AEX | vendor | v13.0.0.1 | v14.0.0 |
v13.0.0.1 is the listed affected versionv14.0.0, treat as exposed and contact AEX supportUpgrade BigFix AEX to v14.0.0 (HCL says the upgrade remediates; AEX support team assists with the upgrade).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.
This page as .md · .json · in your agent: get_signal("CVE-2026-67073")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.