CVE-2025-15634

—

CVSS 4.0

5.3 medium

EPSS

<1%p8

Published

May 9, 2026 (May 9, 2026)

Modified

Jul 25, 2026

Description

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.

Vendors: hcltech
Products: bigfix webui api, bigfix webui application administration, bigfix webui cmep, bigfix webui common, bigfix webui content app, bigfix webui custom, bigfix webui data sync, bigfix webui extensions, bigfix webui framework, bigfix webui insights, bigfix webui ivr, bigfix webui mdm
Weakness: CWE-862
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.