{"id":"CVE-2026-67080","kind":"vulnerability","aliases":["CVE-2026-67080"],"related":[],"title":"HCL BigFix AEX: error handling leaks stack traces and internal paths","description":"HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further attacks.","summary":"HCL BigFix AEX mishandles errors and exceptional conditions, so responses can expose stack traces, system details and internal paths. An attacker who triggers those errors gets technical information that could help plan further attacks.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bigfix","hcl","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T13:17:08+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:18+00:00","updated_at":"2026-10-28T13:34:18+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-28T13:34:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HCL BigFix AEX: error handling leaks stack traces and internal paths","impact":"low","summary":"HCL BigFix AEX mishandles errors and exceptional conditions, so responses can expose stack traces, system details and internal paths. An attacker who triggers those errors gets technical information that could help plan further attacks.","category":"vendor","nicknames":[],"who_cares":["bigfix","hcl"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads stack traces, system details and internal paths","analyst_note":"Check the NVD entry and the HCL BigFix security bulletin for affected AEX versions, the fixed release and whether authentication is required to trigger the errors.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000504,"input_tokens":3310,"output_tokens":346,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-67080':14A,17A 'aex':3A,23B,57C 'affect':59C 'allow':76C 'attack':41B,54B,78C,95C 'bigfix':2A,18B,22B,56C 'condit':28B,73C 'could':50B,75C 'cve':12A,15A 'detail':36B,88C 'disclosur':63C 'due':65C 'error':4A,25B,45B,70C 'except':27B,72C 'expos':32B 'facilit':93C 'get':46B 'handl':5A,68C 'hcl':1A,19B,21B,55C 'help':51B 'improp':67C 'includ':84C 'inform':48B,62C,83C 'intern':10A,38B,90C 'leak':6A 'mishandl':24B 'obtain':80C 'path':11A,39B,91C 'plan':52B 'potenti':92C 'respons':30B 'sensit':81C 'stack':7A,33B,85C 'system':35B,87C 'technic':47B,82C 'trace':8A,34B,86C 'trigger':43B 'vendor':20B 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67080","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67080","severity":null,"published_at":"2026-10-28T13:17:08+00:00","modified_at":"2026-10-28T13:17:08+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}