VulnerabilityAwaiting Analysis
CVE-2026-21785
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized…
MEDIUM 4.0EPSS 0.15%
Does this matter?
Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.
Description
A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources.
- CVSS 3.1
- 4.0 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.15% probability · 4th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1021
- Source
- psirt@hcl.com
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.