HCLSoftware BigFix Remote Control Server vulnerabilities

Latest HCLSoftware BigFix Remote Control Server CVEs

Newest publication first

1. CVE-2026-21785 HCL BigFix Remote Control Server WebUI is affected by a misconfigured Content Security Policy

   Published 2026-05-27

   Medium·CVSS 4.0 EPSS 0.15%

   A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.