CVE-2025-0274: HCL Software BigFix Modern Client Management · Missing Authentication
Affects HCL Software BigFix Modern Client ManagementSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 17% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitation evidence
Disclosed: evidence found.
CVE published 16 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| HCL Software BigFix Modern Client Management | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-0274 effectively, European organizations should implement the following specific measures beyond generic advice: 1) Immediately restrict network access to BigFix MCM management interfaces using firewalls, VPNs, or zero-trust network access solutions to limit exposure to trusted administrators only. 2) Employ strong network segmentation to isolate endpoint management systems from general user networks and the internet. 3) Monitor logs and network traffic for anomalous or unauthorized attempts to invoke endpoint actions, enabling rapid detection of exploitation attempts. 4) Enforce multi-factor authentication (MFA) and role-based access controls (RBAC) on all management consoles and APIs to reduce the risk of unauthorized access. 5) Coordinate with HCL Software for timely patch deployment once available and test patches in controlled environments before production rollout. 6) Conduct regular security audits and penetration tests focused on endpoint management infrastructure to identify and remediate access control weaknesses. 7) Educate IT and security teams about the specific risks associated with missing authentication on critical functions and ensure incident response plans include scenarios involving endpoint management compromise. These targeted actions will help reduce the attack surface and limit potential disruption from this vulnerability.
Description
HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.