CVE-2026-21809: low-severity vulnerability in HCLSoftware BigFix Quantum Risk Analyzer
HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive information
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 3.9epss 0.1%
HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected products
HCLSoftware · BigFix Quantum Risk AnalyzerRelated CVEs — HCLSoftware BigFix Quantum Risk Analyzer
In the same product, most dangerous first.
CVE-2026-21808MEDIUMHCL BigFix Quantum Risk Analyzer is affected by logging sensitive informationEPSS 0.1%CVE-2026-21807LOWHCL BigFix Quantum Risk Analyzer is affected by a stack-based buffer overflowEPSS 0.1%CVE-2026-21810MEDIUMHCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checkingEPSS 0.1%