HCL BigFix AEX: Unrestricted file upload and improper access control
Summary
HCL BigFix AEX is affected by an unrestricted file upload and improper access control vulnerability. An attacker can upload malicious or unauthorized files and directly access or download sensitive uploaded content, which may lead to information disclosure, unauthorized access or system compromise. The CVSS vector indicates a network attack without privileges or user interaction, but the vendor has not yet confirmed these conditions.
Affected
- HCL BigFix AEX 13.0.0.1 (per CNA record)
- Versions before 13.0.0.1: Unknown.
Fixed in
Unknown. No fixed version or patch was confirmed in the sources reviewed.
Workaround
Unknown from the vendor. Until HCL publishes guidance, the following measures are suggested:
- Restrict network access to AEX to trusted sources.
- Review which users and systems can upload files.
- Check upload storage for unexpected files.
Exploitation
- Not known to be exploited in the wild; not listed in KEV.
- No known public proof of concept as of the research date; re-check.
- EPSS: 0.22 % (low).
Our recommendation
- Check the HCL advisory KB0134281 for affected versions and patch availability.
- Inventory all AEX instances, including version and internet exposure.
- Restrict AEX network access until a fix is confirmed.
- Review upload permissions and scan upload storage for unexpected files.
- Monitor for vendor updates and re-check exploit status and NVD data.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HCL Security Bulletin KB0134281 support.hcl-software.com
- VulDB CVE-2026-67073 (427968) vuldb.com
- OffSeq Radar: CVE-2026-67073 radar.offseq.com
- Strix: CVE-2026-67073 www.strix.ai
- GCVE CNA data for HCL db.gcve.eu
- HCL BigFix AEX v12.1 Release Notes help.hcl-software.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:56.
Original description (NVD)
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.