$PATCH CAsoon

Advisory feed · Saturday, 24 October 20264,531 CVEs published in the last 7 daysSource: saved copy of NVD from 24 Oct (NVD isn’t answering)Advisory feedDemo · pretend coins and SOL. The CVE records are real.

TLP:CLEARReceivedPublished 24 Oct 2026 · Updated 24 Oct 2026

CVE-2026-108013

6.8MediumCVSS 3.1

BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.

Affected software: HCL Software BigFix Platform
Versions: Platform 11.0.7 and below + 10.0.16 and below
Weakness: Not stated
Assigned by: hcl.com
NVD status: Received

ReferencesNVD https://nvd.nist.gov/vuln/detail/CVE-2026-108013 CVE.org https://www.cve.org/CVERecord?id=CVE-2026-108013 https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134758

The record above is NVD’s, word for word, as read before NVD finished its analysis. Coins say nothing about the flaw.

Launch a coin on CVE-2026-108013

Coins filed under CVE-2026-108013

No coins filed yet.

Be the first to file a coin under CVE-2026-108013.

File the first coin

CVE-2026-108013 · Patch Day