---
id: "CVE-2026-67073"
kind: "vulnerability"
aliases: ["CVE-2026-67073"]
title: "HCL BigFix AEX: unrestricted file upload lets attackers read and plant files"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "BigFix AEX", "fixed": ["v14.0.0"], "affected": "v13.0.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bigfix", "bigfix-aex", "endpoint-management", "file-upload", "hcl", "infrastructure", "self-hosted", "unauthenticated"]
not_affected_if: []
published_at: "2026-10-28T13:17:08+00:00"
first_seen_at: "2026-10-28T13:33:01+00:00"
updated_at: "2026-10-28T13:35:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67073", "first_seen_at": "2026-10-28T13:33:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T13:35:04+00:00"}]
---

# HCL BigFix AEX: unrestricted file upload lets attackers read and plant files

HCL BigFix AEX has an unrestricted file upload flaw combined with improper access control. An attacker can upload unauthorized files and directly access or download sensitive uploaded content, which can lead to information disclosure or system compromise.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:BigFix AEX affected v13.0.0.1 fixed v14.0.0

## How to check

Check your BigFix AEX version (admin console/about page or deployment release tag); v13.0.0.1 is the listed affected version. HCL gives no other check. If you run older than v14.0.0, treat as exposed and contact AEX support.

## Fix

Upgrade BigFix AEX to v14.0.0 (HCL says the upgrade remediates; AEX support team assists with the upgrade).

## Timeline

- 2026-10-28T13:33:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67073
- 2026-10-28T13:35:04+00:00 analyst — Read HCL bulletin KB0134281 (vendor, 2026-10-28) via browser: affected v13.0.0.1, fixed in v14.0.0, CVSS 8.6 PR:N (unauthenticated per vector). No exploitation/PoC found; no discussion searched (fresh, low-profile). Bulletin gives no check command; version check is inferred. Same bulletin covers CVE-2026-67074 RCE (9.1), 67080, 67079, 67077.

## Documents

- [advisory] HCL Security Bulletin: BigFix AEX is affected by multiple security vulnerabilities (KB0134281) https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134281

## From the sources

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_