What is CVE-2026-21809?

CVE-2026-21809 is a low-severity vulnerability in Hclsoftware Bigfix Quantum Risk Analyzer, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 3.9/10. Published 2026-08-26.

How severe is CVE-2026-21809?

Low severity. CVSS v3 base score is 3.9 out of 10.

Information disclosure in Hclsoftware Bigfix Quantum Risk Analyzer

CVE-2026-21809

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input.

CVSS v3 metric

CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L.

Affected products

Hclsoftware Bigfix Quantum Risk Analyzer — versions 2.0.1.47

Weakness classification (CWE)

CWE-209 — Generation of Error Message Containing Sensitive Information

References

psirt@hcl.com

Frequently asked questions

What is CVE-2026-21809?: CVE-2026-21809 is a low-severity vulnerability in Hclsoftware Bigfix Quantum Risk Analyzer, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 3.9/10. Published 2026-08-26.
How severe is CVE-2026-21809?: Low severity. CVSS v3 base score is 3.9 out of 10.