CVE-2026-67073

{
  "etk_id": "ETK-2026-2879",
  "cve_id": "CVE-2026-67073",
  "display_id": "CVE-2026-67073",
  "ghsa_id": "GHSA-wh53-7j74-8hmx",
  "euvd_id": "EUVD-2026-112030",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unrestricted file upload in HCL BigFix AEX",
  "summary": "HCL BigFix AEX has a file-upload and access-control flaw affecting exposed deployments. An unauthenticated remote attacker may be able to submit unauthorized files and access uploaded sensitive content, potentially enabling disclosure, unauthorized access, or further compromise.",
  "mitigation": "Restrict network access to BigFix AEX to trusted users and networks, and require authentication and authorization for file upload and download functions. Obtain and apply the vendor's applicable update when its fixed release information is available.",
  "vendor": "HCL Software",
  "product": "BigFix AEX",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "v13.0.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "BigFix AEX",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.7796162,
  "t0_at": "2026-10-28T12:24:30.101000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T12:24:30.101000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T12:24:30.101000+00:00",
      "url": "https://github.com/advisories/GHSA-wh53-7j74-8hmx"
    }
  }
}