CVE-2026-67103 is a Cross-Site Scripting (XSS) vulnerability in HCL BigFix Service Management version 23. The flaw arises from improper neutralization of input during web page generation, allowing an attacker with low privileges to inject unsanitized malicious scripts. These scripts execute in the victim's browser, enabling session hijacking, account takeover, and unauthorized actions on behalf of affected users. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of other users' browsers, leading to session hijacking, account takeover, and unauthorized actions. The vulnerability requires low attack complexity and privileges but user interaction is required. The confidentiality impact is high, integrity impact is low, and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit exposure by restricting access to trusted users and applying web application security best practices relevant to XSS mitigation.