CVE-2026-21785

Full vulnerability record from the local CVENow database.

Description

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.

Severity

MEDIUM

CVSS score

4.0 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-05-27 21:16:17.327000

Last modified

2026-10-26 12:10:00.130000

View original CVE JSON

{
  "id": "CVE-2026-21785",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T21:16:17.327",
  "lastModified": "2026-10-26T12:10:00.130",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources."
    },
    {
      "lang": "es",
      "value": "Una Política de Seguridad de Contenido (CSP) mal configurada en la Interfaz de Usuario Web (WebUI) del Servidor de Control Remoto HCL BigFix (versiones 10.1.0.0442 y anteriores) no define directivas sin mecanismos de reserva, permitiendo a los atacantes eludir las restricciones de seguridad previstas y cargar recursos no autorizados."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "HCLSoftware",
          "product": "BigFix Remote Control Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "<= versions 10.1.0.0442",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T13:12:44.221065Z",
          "id": "CVE-2026-21785",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1021"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130581",
      "source": "[email protected]"
    }
  ]
}