PT-2026-37634 · Hcl · Bigfix Service Management

Published 2026-05-06 · Updated 2026-05-06 · CVE-2025-31978

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL BigFix Service Management (SM) (affected versions not specified)

Description HCL BigFix Service Management (SM) fails to adequately sanitize or safely render spreadsheet files, specifically CSV, XLS, and XLSX formats, before they are processed or distributed. This allows an attacker to populate data fields that, when saved to a CSV file, may trigger information exfiltration or other malicious activities upon automatic execution by the spreadsheet software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2025-31978

Affected Products

Bigfix Service Management

References · 5

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31978 · Security Note
• https://twitter.com/infoflowcloud/status/2052038431262347522 · Twitter Post
• https://twitter.com/CVEnew/status/2052037434352034264 · Twitter Post
• https://t.me/CVEtracker/52870 · Telegram Post