What is CVE-2026-67100?

CVE-2026-67100 is a critical-severity vulnerability, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-09-18.

How severe is CVE-2026-67100?

Critical severity. CVSS v3 base score is 9.8 out of 10.

CVE-2026-67100

CVE-2026-67100

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.

Vulnerability class: SQL Injection

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Weakness classification (CWE)

CWE-89 — SQL Injection
CWE-200 — Information Disclosure

References

psirt@hcl.com

Frequently asked questions

What is CVE-2026-67100?: CVE-2026-67100 is a critical-severity vulnerability, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-09-18.
How severe is CVE-2026-67100?: Critical severity. CVSS v3 base score is 9.8 out of 10.