CVE-2026-67106 is an information disclosure vulnerability in HCL BigFix Service Management where two API endpoints expose sensitive information to unauthorized actors. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and CWE-209. The CVSS v3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and only confidentiality impact. No patch or remediation details are provided in the available data.

The vulnerability allows unauthorized actors to access sensitive information through exposed API endpoints. While the impact is limited to confidentiality loss, this information disclosure could enable attackers to plan more serious attacks. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor HCL Software advisories for updates. Until a fix is available, restrict access to the affected API endpoints and apply network-level controls to limit exposure.