CVE-2026-56597 describes a vulnerability in HCL BigFix Service Management version 27 where sensitive internal IP address information is exposed to unauthorized actors via application responses. This information disclosure could facilitate network reconnaissance by attackers. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 3.1 base score of 3.1, reflecting low severity due to network attack vector, high attack complexity, low privileges required, and no user interaction needed. No vendor advisory or patch information is available at this time.

An unauthenticated attacker can extract internal IP addresses from the application's responses, potentially allowing them to map the internal network topology. This information disclosure does not directly impact confidentiality, integrity, or availability beyond the leakage of internal network details. No active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure of the affected application to trusted networks and monitor for unusual access patterns related to information disclosure attempts.