CVE-2026-21821 identifies the use of an unmaintained third-party component, specifically the jQuery 1.x library, in HCL BigFix SCM Reporting version 11.0.5. The jQuery 1.x library has reached end-of-life and no longer receives security updates, which may expose the application to publicly known vulnerabilities. This can increase the risk of client-side attacks such as Cross-Site Scripting (XSS) or other manipulations leveraging weaknesses in the outdated library. The CVSS v3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and user interaction needed. No vendor advisory or patch is currently available to address this issue.

The vulnerability allows attackers to exploit known weaknesses in the outdated jQuery 1.x library used by BigFix SCM Reporting 11.0.5. This can lead to client-side attacks such as Cross-Site Scripting (XSS), potentially compromising confidentiality, integrity, and availability of the affected system. The CVSS score of 8.3 indicates a high impact if exploited. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor HCLSoftware advisories for updates. Until a patch is available, consider limiting access to the affected application and applying any possible compensating controls to reduce exposure to client-side attacks.