HCL BigFix Service Management version 23 contains a Broken Access Control vulnerability (CWE-285) that permits users with low privileges to bypass authorization controls and gain access to administrative interfaces and functions. This unauthorized access could lead to compromise of confidentiality and integrity, as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: None). The vulnerability was published on 2026-09-18 and has a CVSS 3.1 base score of 8.1, reflecting its high severity.

Exploitation of this vulnerability could allow an attacker with low privileges to access and potentially manipulate administrative features, leading to high confidentiality and integrity impacts. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor HCL Software advisories for updates. Until a fix is available, restrict access to the affected version and consider additional access controls or monitoring to detect unauthorized administrative access attempts.