← Vulnerability feed

Vulnerability record · CVE-2021-27765 · published 6 May 2022

CVE-2021-27765: Hcltech bigfix platform improper privilege management vulnerability

Hcltech · Bigfix Platform

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

7.8 CVSS 3.1 High EPSS 0.34% · top 75.3% CWE-269 · Improper privilege management
7.8CVSS 3.1 base score, v2 4.6
0.34%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0023/MNDT-2022-0023.md ExploitThird Party Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116 Vendor Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0023/MNDT-2022-0023.md ExploitThird Party Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116 Vendor Advisory

Track CVE-2021-27765 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-27762Hcltech bigfix platform vulnerabilityMisconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responsesEPSS 0.72%8.8CVE-2024-23554Hcltech bigfix platform cross-site request forgery vulnerabilityCross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).EPSS 0.27%8.8CVE-2023-37536Apache xerces-c\+\+ integer overflow vulnerabilityAn integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.EPSS 1.4%7.8CVE-2026-21765Hcltech bigfix platform incorrect default permissions vulnerabilityHCL BigFix Platform is affected by insecure permissions on private cryptographic keys.  The private cryptographic keys located on a Windows host mach…EPSS 0.10%7.8CVE-2022-38659Hcltech bigfix platform inadequate encryption strength vulnerabilityIn specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.EPSS 0.13%7.8CVE-2021-27766Hcltech bigfix platform improper privilege management vulnerabilityThe BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to per…EPSS 0.19%7.8CVE-2021-27767Hcltech bigfix platform improper privilege management vulnerabilityThe BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to pe…EPSS 0.19%7.5CVE-2024-23556Hcltech bigfix platform vulnerabilitySSL/TLS Renegotiation functionality potentially leading to DoS attack vulnerability.EPSS 0.37%

Source: NIST National Vulnerability Database (record CVE-2021-27765), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.