CVE-2026-67172 describes an information disclosure vulnerability in HCL BigFix Service Management. The application returns sensitive information within error messages triggered by invalid inputs to specific API endpoints. This exposure could provide attackers with information useful for further exploitation attempts. The vulnerability has a CVSS 3.1 base score of 3.7, indicating low severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and only confidentiality impact.

The vulnerability allows disclosure of sensitive information through error messages, which could help an attacker in reconnaissance or crafting subsequent attacks. There is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time.