CVE-2025-52622: HCL Software BigFix SaaS Remediate · Insecure Default
Affects HCL Software BigFix SaaS RemediateSource CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 2 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| HCL Software BigFix SaaS Remediate | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-52622, organizations should immediately verify and enforce the presence of critical HTTP security headers in responses from the BigFix SaaS Remediate platform. Specifically, implement or ensure the following headers are correctly configured: Content-Security-Policy (CSP) to restrict sources of executable scripts and prevent XSS; X-Frame-Options or the newer Content-Security-Policy frame-ancestors directive to prevent Clickjacking by disallowing framing by unauthorized domains; Strict-Transport-Security (HSTS) to enforce secure HTTPS connections and prevent protocol downgrade attacks; and X-Content-Type-Options to prevent MIME sniffing. Since this is a SaaS product, coordinate with HCL Software support or your vendor contact to confirm when patches or configuration updates will be released. In parallel, apply web application firewall (WAF) rules to detect and block common XSS and Clickjacking attempts targeting the platform. Educate users about the risks of interacting with suspicious links or content within the BigFix SaaS interface. Regularly monitor security advisories from HCL and apply updates promptly once available. Additionally, conduct periodic security assessments and penetration tests focusing on client-side security controls to ensure no regression or new issues arise.
Description
The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, making it more vulnerable to common web attacks that these headers are designed to mitigate, such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.