CVE-2026-67080
Received
Received - Intake
Information Disclosure in HCL BigFix AEX
Vulnerability report for CVE-2026-67080, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-28
Last updated on: 2026-10-28
Assigner: HCL Software
Description
Description
HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further attacks.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| HCL Software | BigFix AEX | v13.0.0.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-391 | [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed. |
| CWE-755 | The product does not handle or incorrectly handles an exceptional condition. |
| CWE-209 | The product generates an error message that includes sensitive information about its environment, users, or associated data. |
