Description
The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| HCLSoftware | BigFix MCM & Mobile | <= 3.7 | — |
Advisories 1
- WID-SEC-2026-4366 HCL BigFix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2026