CVE-2026-67105 describes an insecure communication vulnerability (CWE-319) in HCL BigFix Service Management. The product transmits sensitive information in cleartext over HTTP between backend services, which can be intercepted by an attacker with internal network access. This exposure can lead to data confidentiality breaches and facilitate man-in-the-middle attacks. The CVSS 3.1 score is 7.4, reflecting high impact on confidentiality and integrity, with no impact on availability. No vendor advisory or patch information is provided, and the product is not a cloud service.

An attacker with access to the internal network could intercept unencrypted HTTP traffic between backend services of HCL BigFix Service Management. This could result in disclosure of sensitive information and enable man-in-the-middle attacks, compromising confidentiality and integrity of data. There is no indication of known exploits in the wild. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider mitigating the risk by restricting internal network access, using network segmentation, or deploying encryption (e.g., TLS) for backend service communications if configurable.