Hcltech Bigfix Modern Client Management vulnerabilities

6 CVEs affecting Hcltech Bigfix Modern Client Management, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0277, published 2025-10-16.

More from Hcltech.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-27783, published 2022-05-25. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
• CVE-2023-28025, published 2023-12-21. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive…
• CVE-2025-0277, published 2025-10-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly…
• CVE-2025-0276, published 2025-10-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing…
• CVE-2025-0275, published 2025-10-16. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
• CVE-2025-0274, published 2025-10-16. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to…