{"id":"CVE-2026-67073","kind":"vulnerability","aliases":["CVE-2026-67073"],"related":[],"title":"HCL BigFix AEX: unrestricted file upload lets attackers read and plant files","description":"HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.","summary":"HCL BigFix AEX has an unrestricted file upload flaw combined with improper access control. An attacker can upload unauthorized files and directly access or download sensitive uploaded content, which can lead to information disclosure or system compromise.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BigFix AEX","fixed":["v14.0.0"],"affected":"v13.0.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["bigfix","bigfix-aex","endpoint-management","file-upload","hcl","infrastructure","self-hosted","unauthenticated"],"not_affected_if":[],"how_to_check":"Check your BigFix AEX version (admin console/about page or deployment release tag); v13.0.0.1 is the listed affected version. HCL gives no other check. If you run older than v14.0.0, treat as exposed and contact AEX support.","fix":"Upgrade BigFix AEX to v14.0.0 (HCL says the upgrade remediates; AEX support team assists with the upgrade).","status":"open","published_at":"2026-10-28T13:17:08+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:33:59+00:00","updated_at":"2026-10-28T13:35:04+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-28T13:33:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HCL BigFix AEX: unrestricted file upload lets attackers read and plant files","impact":"high","summary":"HCL BigFix AEX has an unrestricted file upload flaw combined with improper access control. An attacker can upload unauthorized files and directly access or download sensitive uploaded content, which can lead to information disclosure or system compromise.","category":"infrastructure","nicknames":[],"who_cares":["bigfix","hcl","endpoint-management"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker uploads files and reads sensitive uploaded content, possibly compromising the system","analyst_note":"Check the HCL BigFix AEX security bulletin for affected versions, fixed versions, and whether authentication is required; NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67073","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000531,"input_tokens":3318,"output_tokens":398,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the HCL BigFix AEX security bulletin for affected versions, fixed versions, and whether authentication is required; NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67073","search":"'-2026':14A,17A '-67073':15A,18A 'access':49B,59B,86C,102C,114C 'aex':3A,20A,24B,39B,76C 'affect':78C 'allow':91C 'attack':8A,52B,93C 'bigfix':2A,19A,21B,23B,38B,75C 'bigfix-aex':22B 'combin':46B 'compromis':73B,117C 'content':64B,107C 'control':50B,87C 'could':90C 'cve':13A,16A 'direct':58B,101C 'disclosur':70B,112C 'download':61B,104C 'endpoint':26B 'endpoint-manag':25B 'file':5A,12A,29B,43B,56B,82C,99C 'file-upload':28B 'flaw':45B 'hcl':1A,31B,37B,74C 'host':35B 'improp':48B,85C 'inform':69B,111C 'infrastructur':32B 'lead':67B,109C 'let':7A 'malici':96C 'manag':27B 'plant':11A 'potenti':108C 'read':9A 'self':34B 'self-host':33B 'sensit':62B,105C 'system':72B,116C 'unauthent':36B 'unauthor':55B,98C,113C 'unrestrict':4A,42B,81C 'upload':6A,30B,44B,54B,63B,83C,95C,106C 'vulner':88C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a self-hosted (on-premises) HCL BigFix AEX v13.0.0.1 agentic AI platform. The CVSS vector says the file upload endpoint needs no login and is reachable over the network, so an instance exposed beyond the internal network is the main concern. Teams not running AEX can skip it. The bulletin does not say whether the SaaS service is affected.","tier":"B","verified":{"fix":{"at":"2026-10-28T13:35:04Z","by":"analyst","run_id":954},"products":{"at":"2026-10-28T13:35:04Z","by":"analyst","run_id":954},"who_affected":{"at":"2026-10-28T13:35:04Z","by":"analyst","run_id":954}},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67073","severity":null,"published_at":"2026-10-28T13:17:08+00:00","modified_at":"2026-10-28T13:17:08+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-67073:954","url":null,"severity":null,"published_at":"2026-10-28T13:35:04+00:00","modified_at":"2026-10-28T13:35:04+00:00","first_seen_at":"2026-10-28T13:35:04+00:00","fetched_at":"2026-10-28T13:35:04+00:00","note":"Read HCL bulletin KB0134281 (vendor, 2026-10-28) via browser: affected v13.0.0.1, fixed in v14.0.0, CVSS 8.6 PR:N (unauthenticated per vector). No exploitation/PoC found; no discussion searched (fresh, low-profile). Bulletin gives no check command; version check is inferred. Same bulletin covers CVE-2026-67074 RCE (9.1), 67080, 67079, 67077."}],"documents":[{"id":10704,"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134281","title":"HCL Security Bulletin: BigFix AEX is affected by multiple security vulnerabilities (KB0134281)","kind":"advisory","source":"analyst","text":"HCL Security Bulletin KB0134281 (published 2026-10-28): HCL BigFix AEX is affected by multiple security vulnerabilities.\nCVE-2026-67073: Unrestricted File Upload and Improper Access Control. Attacker can upload malicious or unauthorized files and directly access or download sensitive uploaded content. CVSS 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L (no privileges required).\nSame bulletin: CVE-2026-67074 RCE (9.1, PR:H), CVE-2026-67080, 67079, 67077.\nAffected: BigFix AEX v13.0.0.1\nRemediation: fixed in BigFix AEX v14.0.0; older versions upgrade to v14.0.0; AEX support team assists.\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}