CVE-2026-21809
HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input.
Scoring
- Severity
- LOW
- CVSS base score
- 3.9
- CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
- EPSS probability
- 0.09%
- CWE
- CWE-209
- Published
- 2026-08-26
- Last modified
- 2026-08-27
Affected products
- HCLSoftware BigFix Quantum Risk Analyzer
Weakness type
Related vulnerabilities
- CVE-2026-66306 — Skype for Business Information Disclosure Vulnerability
- CVE-2026-69294 — Microsoft COM for Windows Information Disclosure Vulnerability
- CVE-2026-68886 — Windows Network Connection Broker Information Disclosure Vulnerability
- CVE-2026-67383 — Microsoft SQL Server Information Disclosure Vulnerability
- CVE-2026-69684 — Windows Error Reporting Information Disclosure Vulnerability
- CVE-2026-69552 — Windows Print Spooler Components Information Disclosure Vulnerability
- CVE-2026-11873 — Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure
- CVE-2026-82739 — Ash.Resource.Validation.Confirm leaks a confirmed field's stored value in the atomic mismatch error