CVE-2025-31985 is a vulnerability in HCL BigFix Service Management (SM) version 23 caused by the absence or misconfiguration of the 'X-Content-Type-Options' HTTP header. This header is intended to prevent browsers from MIME-type sniffing, which can lead to security issues such as exposure of sensitive information. Without this header, browsers might incorrectly interpret content types, potentially exposing data to unauthorized actors. The vulnerability has a CVSS v3.1 base score of 3.7, indicating low severity. No official remediation or patch has been documented, and the product is not a cloud service, so remediation depends on vendor updates or user configuration changes.

The vulnerability could allow browsers to perform MIME-type sniffing, which may cause sensitive information to be exposed to unauthorized actors. The impact is limited to information disclosure with no direct integrity or availability impact. The CVSS score of 3.7 reflects a low severity, indicating limited risk under typical conditions. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing security headers manually, including setting the 'X-Content-Type-Options' header to 'nosniff' in their web server or application configuration to mitigate the risk of MIME-type sniffing.