CVE-2026-21809: CWE-209 Generation of error message containing sensitive information in HCLSoftware BigFix Quantum Risk Analyzer

CVE-2026-21809 describes a vulnerability in HCL BigFix Quantum Risk Analyzer 2.0.1.47 where the validation process produces overly descriptive error messages when encountering malformed input. These detailed error messages can leak sensitive information, enabling attackers to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to generate valid inputs. The vulnerability is classified under CWE-209 (Generation of error message containing sensitive information).

The vulnerability can lead to information disclosure through error messages that reveal sensitive details about the system's validation process. This information can assist attackers in crafting more effective attacks by understanding input validation mechanisms. However, the overall impact is limited as indicated by the low CVSS score of 3.9, reflecting low confidentiality, integrity, and availability impacts.

No official patch or remediation level has been provided by the vendor as of the published date. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider minimizing exposure of the affected version and monitor for updates from HCLSoftware.