HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy

published 2026-05-27 5 mo ago modified 2026-10-26 13 d ago also EUVD-2026-32658

cvss: 4.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 4%
public exploits: 0; none known

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 5 mo ago (2026-05-28)

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.0	CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected products

HCLSoftware BigFix Remote Control Server

Classification

Weakness

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

References

support.hcl-software.com /csm?id=kb_article&sysparm_article=KB0130581

Sources

CVE List CVE-2026-21785
NVD CVE-2026-21785

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary