CVE-2026-108013 HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-108013?
CVE-2026-108013 is a medium-severity vulnerability in HCL Software BigFix Platform, published on 24 Oct 2026.
Official description
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
Which versions are affected by CVE-2026-108013?
How do I fix CVE-2026-108013?
No fix has been published for CVE-2026-108013 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-108013 being exploited?
There is no known exploitation of CVE-2026-108013 in the wild and no public exploit code.
Sources
Also known as GHSA-x7j6-r59g-9w4v.