CVE-2025-52621

7.5 highEPSS 0.2%

High (7.5) in hcltech bigfix saas. EPSS 0.2% chance of exploitation in the next 30 days.

HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 4% of CVEs (scores of 2026-10-31)
CWE: CWE-346
Published: 2025-08-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hcltech:bigfix_saas

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330

Check your stack JSON