Loading story…
HCL disclosed two high-severity vulnerabilities affecting HCL Aftermarket DPC and the HCL BigFix Platform, with both issues exposing organizations to significant compromise risk. CVE-2025-55261 affects HCL Aftermarket DPC and is described as Missing Functional Level Access Control (CWE-284), a flaw that could let an attacker escalate privileges, compromise the application, and steal or manipulate data. The issue carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, indicating network exposure with high impact to confidentiality and availability.
HCL also reported CVE-2026-21765 in the HCL BigFix Platform, where insecure permissions on private cryptographic keys stored on Windows hosts could expose sensitive keys to local users. The weakness maps to CWE-276 and CWE-732, reflecting incorrect default permissions and improper permission assignment for critical resources, and received a CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Together, the disclosures highlight risks from weak access controls and improperly protected cryptographic material in enterprise HCL software, with HCL directing customers to its support advisories for remediation details.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-02, a new vulnerability, CVE-2026-21765, was reported for the HCL BigFix Platform. The issue involves insecure permissions on private cryptographic keys on Windows hosts, potentially exposing keys because of overly permissive file system permissions.
HCL's PSIRT received CVE-2025-55261 on 2026-03-26 for a Missing Functional Level Access Control flaw in HCL Aftermarket DPC. The vulnerability could allow privilege escalation, application compromise, and theft or manipulation of data, and HCL published a support advisory for additional details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German government CERT advisories disclosed multiple vulnerabilities affecting the **HCL BigFix Platform**, with separate notices identifying security issues in the enterprise endpoint management product. The advisories indicate that more than one flaw was reported across BigFix components, expanding the scope of risk for organizations that rely on the platform for device management, patching, and compliance operations. The notices provide limited public detail, but the repeated publication of advisories on **HCL BigFix** suggests ongoing remediation activity and a need for defenders to review vendor guidance, assess exposed BigFix infrastructure, and prioritize patch deployment. Organizations using BigFix should verify affected versions, apply available updates, and monitor administrative systems for signs of misuse while additional technical details remain sparse.
Jun 29, 2026
Hewlett Packard Enterprise released security updates for **HPE Networking Instant On Access Points** to fix two vulnerabilities affecting firmware version `3.2.0.1` and earlier. The most severe issue, **`CVE-2025-37103`**, is a critical hard-coded credentials flaw with a **CVSS score of 9.8** that could allow a remote attacker to gain administrative access to the device web interface. HPE documented the issues in security bulletin **`HPESBNW04894`** and urged customers to update affected systems. HPE also patched **`CVE-2025-37102`**, a high-severity vulnerability with a **CVSS score of 7.2** that allows a remote authenticated attacker to inject arbitrary commands into the device console and execute commands on the underlying system. The company recommended immediate upgrades to firmware version `3.2.1.0` or later to reduce the risk of unauthorized access and command execution on exposed access points.
Jul 24, 2026
Belden disclosed two high-severity vulnerabilities in **Hirschmann Industrial HiVision** that can lead to arbitrary code execution. The more serious issue, tracked as `CVE-2017-20237`, is an authentication bypass in the product's master service that affects versions prior to **06.0.07** and **07.0.03**. An unauthenticated remote attacker can invoke exposed interface methods and execute commands with administrative privileges on the underlying operating system, creating a full remote code execution path with high impact to confidentiality, integrity, and availability. A second flaw, `CVE-2022-4987`, affects **08.1.03** prior to **08.1.04** and **08.2.00** and stems from improper sanitization of paths used to launch user-configured external applications. In that scenario, a low-privileged local attacker can place a malicious binary in the execution path so it runs instead of the intended program, potentially gaining elevated execution depending on deployment context. The vulnerabilities were documented in Belden security guidance and VulnCheck advisories, highlighting both remote and local routes to code execution in Industrial HiVision deployments.
Jun 29, 2026