HCL Software vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-67074 HCL BigFix AEX is affected by a Remote Code Execution Vulnerability .Critical 9.1 · Oct 28, 2026
• CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability.High 8.6 · Oct 28, 2026
• CVE-2026-67105 HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unHigh 7.4 · Oct 1, 2026
• CVE-2026-56589 HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scriHigh 7.2 · Oct 1, 2026
• CVE-2026-66246 iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object High 8.8 · Oct 1, 2026
• CVE-2026-67103 HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts thaHigh 7.6 · Sep 18, 2026
• CVE-2026-67102 HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized aHigh 8.1 · Sep 18, 2026
• CVE-2026-67101 HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to foCritical 9.3 · Sep 18, 2026
• CVE-2026-67100 HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities.Critical 9.8 · Sep 18, 2026
• CVE-2024-23564 HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirecCritical 9.1 · Jul 17, 2026
• CVE-2026-35149 HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.High 8.2 · Jul 16, 2026
• CVE-2026-35147 HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.High 8.2 · Jul 16, 2026
• CVE-2025-59874 HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application.High 8.1 · Jun 4, 2026
• CVE-2025-52612 HCL iControl was affected by Export CSV - CSV Injection vulnerability.High 7.1 · Jun 4, 2026
• CVE-2024-30151 HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.High 8.3 · May 6, 2026
• CVE-2025-31951 HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability.High 8.8 · May 6, 2026
• CVE-2025-55263 HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories,High 7.3 · Mar 26, 2026
• CVE-2025-55262 HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database.High 8.3 · Mar 26, 2026
• CVE-2025-55261 HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the applicatiHigh 8.1 · Mar 26, 2026
• CVE-2025-62319 Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into applCritical 9.8 · Mar 16, 2026
• CVE-2025-59870 HCL MyXalytics  is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a securiHigh 7.4 · Jan 16, 2026
• CVE-2025-0248 HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input.High 8.1 · Nov 25, 2025
• CVE-2025-55278 Improper authentication in the API authentication middleware of HCL DevOps Loop allows authentication tokens to be accepted without proper validation of their eHigh 8.1 · Nov 5, 2025
• CVE-2025-52650 Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0High 8.2 · Oct 10, 2025
• CVE-2025-52656 HCL MyXalytics: 6.6.High 7.6 · Oct 3, 2025