CVE-2026-21785 — MEDIUM (4.0)

Vulnerability Description

A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.

CVSS Score

4.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Related Weaknesses (CWE)

CWE-1021

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130581

FAQ

What is CVE-2026-21785?

CVE-2026-21785 is a vulnerability with a CVSS score of 4.0 (MEDIUM). A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass in...

How severe is CVE-2026-21785?

CVE-2026-21785 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-21785?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.