{"id":"CVE-2026-67074","kind":"vulnerability","aliases":["CVE-2026-67074"],"related":[],"title":"HCL BigFix AEX: remote code execution lets attackers run code","description":"HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.","summary":"HCL BigFix AEX v13.0.0.1 has a remote code execution flaw (CVSS 9.1). It is reachable over the network but needs a high-privilege account. Code runs with the privileges of the AEX application or service. HCL fixed it in v14.0.0. No exploitation reported.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BigFix AEX","fixed":["v14.0.0"],"affected":"v13.0.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","bigfix","bigfix-aex","hcl","other","rce","self-hosted"],"not_affected_if":["not-running-bigfix-aex","version-14.0.0-or-later"],"how_to_check":"Check your BigFix AEX version in the admin console or deployment. v13.0.0.1 is listed as affected. Move to v14.0.0.","fix":"Upgrade BigFix AEX to v14.0.0 (HCL: upgrading older versions to v14.0.0 fixes it; HCL's AEX support team assists).","status":"open","published_at":"2026-10-28T13:17:08+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:33:55+00:00","updated_at":"2026-10-28T13:34:55+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-28T13:33:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HCL BigFix AEX: remote code execution lets attackers run code","impact":"high","summary":"HCL BigFix AEX has a remote code execution flaw, according to the NVD entry. An attacker could execute code with the privileges of the affected application or service, which can lead to unauthorized access or system compromise.","category":"other","nicknames":[],"who_cares":["bigfix","hcl"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker runs code with the service's privileges on the host","analyst_note":"Find the HCL advisory and affected versions, the fixed release, and whether the flaw is network reachable, via https://nvd.nist.gov/vuln/detail/CVE-2026-67074 and HCL's BigFix security bulletins.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000512,"input_tokens":3287,"output_tokens":367,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the HCL advisory and affected versions, the fixed release, and whether the flaw is network reachable, via https://nvd.nist.gov/vuln/detail/CVE-2026-67074 and HCL's BigFix security bulletins.","search":"'-2026':12A,15A '-67074':13A,16A '9.1':41B 'access':105C 'account':54B 'aex':3A,18A,23B,32B,62B,76C 'affect':78C,97C 'allow':87C 'applic':63B,98C 'attack':8A,88C 'authent':19B 'bigfix':2A,17A,20B,22B,31B,75C 'bigfix-aex':21B 'code':5A,10A,37B,55B,82C,91C 'compromis':110C 'cve':11A,14A 'cvss':40B 'data':106C 'execut':6A,38B,83C,90C 'exploit':72B 'exposur':107C 'fix':67B 'flaw':39B 'hcl':1A,24B,30B,66B,74C 'high':52B 'high-privileg':51B 'host':29B 'lead':102C 'let':7A 'may':86C 'need':49B 'network':47B 'potenti':101C 'privileg':53B,59B,94C 'rce':26B 'reachabl':44B 'remot':4A,36B,81C 'report':73B 'run':9A,56B 'self':28B 'self-host':27B 'servic':65B,100C 'system':109C 'unauthor':104C 'v13.0.0.1':33B 'v14.0.0':70B 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{"fix":{"at":"2026-10-28T13:34:55Z","by":"analyst","run_id":953},"products":{"at":"2026-10-28T13:34:55Z","by":"analyst","run_id":953}},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67074","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67074","severity":null,"published_at":"2026-10-28T13:17:08+00:00","modified_at":"2026-10-28T13:17:08+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-67074:953","url":null,"severity":null,"published_at":"2026-10-28T13:34:55+00:00","modified_at":"2026-10-28T13:34:55+00:00","first_seen_at":"2026-10-28T13:34:55+00:00","fetched_at":"2026-10-28T13:34:55+00:00","note":"HCL bulletin KB0134281 (28 Oct 2026, read via browser): affects BigFix AEX v13.0.0.1, fixed in v14.0.0. CVSS 9.1 AV:N/PR:H (needs high-privilege account, scope changed). No exploitation or PoC found; bulletin gives no technical detail, workaround or mitigation. Sibling CVE-2026-67073 is in the same bulletin."}],"documents":[{"id":10704,"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134281","title":"HCL Security Bulletin: BigFix AEX is affected by multiple security vulnerabilities (KB0134281)","kind":"advisory","source":"analyst","text":"HCL Security Bulletin KB0134281 (published 2026-10-28): HCL BigFix AEX is affected by multiple security vulnerabilities.\nCVE-2026-67073: Unrestricted File Upload and Improper Access Control. Attacker can upload malicious or unauthorized files and directly access or download sensitive uploaded content. CVSS 8.6, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L (no privileges required).\nSame bulletin: CVE-2026-67074 RCE (9.1, PR:H), CVE-2026-67080, 67079, 67077.\nAffected: BigFix AEX v13.0.0.1\nRemediation: fixed in BigFix AEX v14.0.0; older versions upgrade to v14.0.0; AEX support team assists.\n","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}