Vulnerability feed

Executive summary

The advisory says that the BigFix Platform ships an outdated Mozilla CA certificate bundle that still trusts certificates whose private keys have been compromised. An attacker positioned between the product and a server could impersonate that server and tamper with files the product downloads. The advisory states the fix is to use a bundle dated 2026/10/20 or later, available starting from BES Support v1520.

Technical summary

This is a trust validation weakness caused by an outdated certificate authority bundle in the BigFix Platform. Bundles dated before 2026/10/20 still trust certificates whose private keys are compromised, so an on-path attacker can impersonate remote servers during validation. The attack requires a network position between the product and the target server, and the advisory describes file tampering as the impact. The fix is bundle version 2026/10/20 or later, available starting from BES Support v1520. The advisory does not state a CVSS score, exploitation status, or any workaround, and it does not give detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affects

MozillaHCL SoftwareBigFixHCL Software BigFix PlatformBigFix PlatformMozilla CA certificate bundle