CVE-2026-21840
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
HCL BigFix Platform is affected by a user enumeration vulnerability. An attacker, through careful system control and response time monitoring, can determine which users are registered with the BigFix service.
Risk Assessment
The risk is that an attacker can gather a list of valid usernames, which may facilitate further attacks such as brute force or phishing.
Recommendation
Apply the vendor-provided update and implement response time masking mechanisms to hinder user enumeration.
Other vulnerabilities in HCL BigFix Platform
Original NVD description (English source)
HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS