6.8
Medium
CVE-2026-108013 BigFix Platform uses Mozilla CA certificate bundle (PEM)
Description
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| BigFix Platform | Versions not published |
References
- support.hcl-software.com support.hcl-software.com
Timeline
- Published
- Last modified
Other CVEs of BigFix Platform
The 22 CVEs of BigFix Platform →
CVE-2024-30117
A dynamic search for a prerequisite library could allow the possibility for an attacker to replace the correct file…
2.5
Low
CVE-2024-23556
SSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability
5.9
Medium
CVE-2024-23554
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution…
5.7
Medium
CVE-2024-23583
An attacker could potentially intercept credentials via the task manager and perform unauthorized access to the Client…
6.7
Medium