CVE-2023-37518: Hcltech Bigfix ServiceNow Data Flow

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user.

Affected products

• Hcltech Bigfix ServiceNow Data Flow: before 1.3 (fixed in 1.3)

Published 2024-01-30. Last modified 2026-06-17.