Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-108018 EUVD-2026-118000GHSA-jc8j-qq6m-2r53

BigFix Mobile is affected by sensitive information disclosure

Published Nov 6, 2026 · Updated Nov 10, 2026 · Assigned by HCL

Description

The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction.  A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts.

Affected products

VendorProductAffectedFixed
HCLSoftware BigFix MCM & Mobile <= 3.7 —

Advisories 1

References