Hcl

By the Year

In 2026 there have been 153 vulnerabilities in Hcl with an average score of 4.5 out of ten. Last year, in 2025 Hcl had 39 security vulnerabilities published. That is, 114 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.62

Recent Hcl Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-56596	Oct 06, 2026	Improper Input Validation in HCL BigFix Service Mgmt (CVE-2026-56596) HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior.	Bigfix
CVE-2026-21833	Oct 01, 2026	HCL AION: Missing CSP Header Enables XSS Risks HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header may reduce the effectiveness of browser-based security controls, potentially resulting in unintended behavior or negative security impacts under certain conditions.	Aion
CVE-2025-31980	Oct 01, 2026	HCL BigFix Service Management Improper Input Validation Allowing Injection HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidated, malformed data into the application, enabling potential injection attacks or errors in downstream processing systems.	Bigfix
CVE-2026-67172	Oct 01, 2026	HCL BigFix SM Info Disclosure via API Error Messages HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks.	Bigfix
CVE-2026-67171	Oct 01, 2026	HCL BigFix Service Management API Info Disclosure via Exposed Endpoint HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks.	Bigfix
CVE-2026-67106	Oct 01, 2026	HCL BigFix SM API Info Disclosure Vulnerability HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.	Bigfix
CVE-2026-56599	Oct 01, 2026	HCL BigFix Service Mgmt Insecure Cookie Attr: CSRF/XSS HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery (CSRF), session hijacking via Cross-Site Scripting (XSS), and unauthorized access.	Bigfix
CVE-2026-67104	Oct 01, 2026	HCL BigFix Service Mgmt: Info Disclosure via Public JS Files HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.	Bigfix
CVE-2026-67105	Oct 01, 2026	Insecure Comm in HCL BigFix SM Unencrypted HTTP Enables MitM HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.	Bigfix
CVE-2026-56589	Oct 01, 2026	HCL BigFix Service Mgmt XSS: Stored Script Injection HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data.	Bigfix
CVE-2026-66253	Oct 01, 2026	HCL iControl Session Timeout flaw enabling unauthorized app access iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of the victim.
CVE-2026-66249	Oct 01, 2026	iControl Missing Secure Attribute: cookie hijack risk iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers.
CVE-2026-66248	Oct 01, 2026	Improper Error Handling in iControl Allows Internal Disclosure iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks.
CVE-2026-66247	Oct 01, 2026	iControl Insecure CORS Policy CVE-2026-66247 iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active session.
CVE-2026-66246	Oct 01, 2026	iControl Broken Access Control IDOR enables privilege escalation iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.
CVE-2025-32000	Sep 24, 2026	HCL Sametime Insufficient Input Sanitization Flaw Enabling XSS HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability.
CVE-2026-21806	Sep 18, 2026	Admin Session Concurrency Vulnerability in HCL BigFix SM HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers. Successful exploitation allows an attacker to compromise affected administrative sessions and execute actions with full privileged user permissions.	Bigfix
CVE-2026-21822	Sep 18, 2026	HCL AppScan 360° ASReportService Path Traversal (CVE-2026-21822) HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.
CVE-2026-56595	Sep 18, 2026	CORS Misconfig in HCL BigFix Server Enables Unauth Access HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.	Bigfix
CVE-2026-56597	Sep 18, 2026	HCL BigFix Service Mgmt. Sensitive Info Leak HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to extract internal IP addresses from the application's responses, enabling them to map the underlying network topology and identify potential internal targets.	Bigfix
CVE-2026-56592	Sep 18, 2026	HCL BigFix SM Improper Auth Permitting Brute-force Login HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access.	Bigfix
CVE-2026-56590	Sep 18, 2026	HCL BigFix Service Management Unrestricted File Upload (CVE-2026-56590) HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could allow an unauthenticated attacker to upload and execute malicious payloads, resulting in a complete server compromise.	Bigfix
CVE-2026-21848	Sep 18, 2026	HCL BigFix SM: Authenticated Access Controls Misconfig Allows CrossTenant Data Exposure HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to exploit improper access controls, enabling the unauthorized viewing of restricted data elements across tenant boundaries.	Bigfix
CVE-2026-67103	Sep 18, 2026	HCL BigFix Service Mgmt XSS Vulnerability Allows Session Hijacking HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users.	Bigfix
CVE-2026-67102	Sep 18, 2026	HCL BigFix Service Management Broken Access Control (CVE-2026-67102) HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for higher-privileged roles.	Bigfix
CVE-2026-67100	Sep 18, 2026	HCL BigFix Service Mgmt: SQLi & Cross-Tenant Data Exposure HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.	Bigfix
CVE-2026-67101	Sep 18, 2026	SSRF in HCL BigFix Service Management Search HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.	Bigfix
CVE-2025-52657	Sep 07, 2026	HCL MyXalytics Potential DOS via Unrestricted Input Length HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of characters which can impact system performance or availability.	Myxalytics
CVE-2025-52652	Sep 07, 2026	HCL MyXalytics Content Spoofing Vulnerability (CVE-2025-52652) HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.	Myxalytics
CVE-2025-52651	Sep 07, 2026	HCL MyXalytics Improper Input Validation Vulnerability HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues.	Myxalytics
CVE-2025-62343	Aug 27, 2026	HCL IEM Admin Session Concurrency Allowing Active Sessions HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion.
CVE-2025-62342	Aug 27, 2026	HCL IEM Session Deletion Vulnerability (CVE-2025-62342) HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion.
CVE-2026-21754	Aug 25, 2026	HCL Hive Infra Config Enables Lateral Movement & Container Breakout HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications.
CVE-2026-21753	Aug 25, 2026	HCL Hive Supply Chain Vulnerability: Weak Governance Enables Malicious Dependencies HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment.
CVE-2026-21758	Aug 25, 2026	HCL Hive Info Disclosure Vulnerability Enabling Host Environment Leak HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.
CVE-2026-21784	Aug 20, 2026	CORS Header Misconfiguration in HCL IntelliOps IEM HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation.
CVE-2025-62299	Aug 20, 2026	Least Privileges Violation in HCL IntelliOps IEM HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.
CVE-2025-62300	Aug 20, 2026	Race Condition in HCL IntelliOps IEM Resource Modification HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior.
CVE-2025-62306	Aug 20, 2026	CVE-2025-62306: HCL IEM Logging Omission Breaches Audit Trail HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response.
CVE-2025-62307	Aug 20, 2026	IEM Logging Gaps in HCL IntelliOps Facilitate Privilege Escalation HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.
CVE-2026-21832	Aug 13, 2026	HCL AION Indirect Prompt Injection HTML Injection HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.	Aion
CVE-2025-62315	Aug 13, 2026	HCL Aion Server-side Input Validation Bypass HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.	Aion
CVE-2025-62318	Aug 13, 2026	HCL AION JavaScript Hijacking via Referenced Responses HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.	Aion
CVE-2025-62314	Aug 13, 2026	HCL AION Endpoint Anti-Automation Bypass (CVE-2025-62314) HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.	Aion
CVE-2025-52640	Aug 13, 2026	HCL AION Shared Storage Access Separation Issue HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions.	Aion
CVE-2025-62347	Jul 31, 2026	HCL iControl Improper Input Validation Vulnerability HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches the expected type.
CVE-2026-56571	Jul 31, 2026	HCL iControl Improper Error Handling Vulnerability (CVE-2026-56571) HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated.
CVE-2026-56570	Jul 31, 2026	HCL iControl AutoComplete InfoDisclosure via Browser Suggestion HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.
CVE-2026-56569	Jul 31, 2026	Sensitive Data Exposure: Public Exposure of Config Files in HCL iControl HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.
CVE-2026-56568	Jul 31, 2026	iControl Info Exposure via Verbose API Error Messages HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and authentication status