← Vulnerability feed

Vulnerability record · CVE-2025-31958 · published 21 April 2026

CVE-2025-31958: Hcltech bigfix service management http request smuggling vulnerability

Hcltech · Bigfix Service Management

HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

8.2 CVSS 3.1 High EPSS 0.18% · top 93.4% CWE-444 · HTTP request smuggling
8.2CVSS 3.1 base score
0.18%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209 Vendor Advisory

Track CVE-2025-31958 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-31973Hcltech bigfix service management vulnerabilityHCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images m…EPSS 0.18%8.8CVE-2025-52613Hcltech bigfix service management information exposure vulnerabilityHCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may e…EPSS 0.23%8.3CVE-2024-30151Hcltech bigfix service management sensitive information in log file vulnerabilityHCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorize…EPSS 0.25%7.5CVE-2025-31976Hcltech bigfix service management information exposure vulnerabilityHCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, int…EPSS 0.16%7.2CVE-2025-31974Hcltech bigfix service management insecure default initialization vulnerabilityHCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow…EPSS 0.18%6.5CVE-2025-31985Hcltech bigfix service management information exposure vulnerabilityHCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This coul…EPSS 0.16%6.5CVE-2025-31982Hcltech bigfix service management information exposure vulnerabilityHCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an incre…EPSS 0.15%6.5CVE-2025-31972Hcltech bigfix service management cleartext transmission vulnerabilityHCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an…EPSS 0.09%

Source: NIST National Vulnerability Database (record CVE-2025-31958), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.