CVE-2026-56619
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.
Risk Assessment
An attacker can execute malicious scripts in the victim's browser, potentially leading to session theft, account takeover, or display of fraudulent content.
Recommendation
Strengthen input validation and output encoding in HCL BigFix Mobile and update to a patched version.
Other vulnerabilities in HCL BigFix Mobile
See all- CVE-2026-56620Medium
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.
- CVE-2025-0277Medium
HCL BigFix Mobile version 3.3 and earlier have insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
- CVE-2025-0275Medium
HCL BigFix Mobile 3.3 and earlier have improper access control, allowing unauthorized users to access a small subset of endpoint actions, potentially enabling access to select internal functions.
Original NVD description (English source)
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS