Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-21806

CVE-2026-21806CRITICAL

HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0020    9.1     —

AFFECTED
  Product                         Versions      Fixed
  HCL BigFix  Service Management  Version 27 –  —

TIMELINE
  Jan 5   Reserved by HCL
  Sep 18  Published (CNA: HCL)
  Oct 14  RESCORED — CVE-2026-21806 (HCL Software HCL BigFix  Service Management). CVSS 3.1 → 9.8 (NVD).

CWE-557 · CNA: HCL · CVSS v3.1 · 1 reference · NVD status: Analyzed

Description

HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneous authenticated sessions for the same administrative account, which could enable an unauthorized attacker to predict or hijack valid session identifiers. Successful exploitation allows an attacker to compromise affected administrative sessions and execute actions with full privileged user permissions.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
January 5, 2026	Reserved	Reserved by HCL
September 18, 2026	Published	Published (CNA: HCL)
October 14, 2026	RESCORED	RESCORED — CVE-2026-21806 (HCL Software HCL BigFix Service Management). CVSS 3.1 → 9.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
HCL Software	HCL BigFix Service Management	—	Version 27	—

Weaknesses

CWE-557

References (1)

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133592 [Vendor Advisory]

Authoritative record: CVE-2026-21806 at cve.org

Vendors: hcl software

Weaknesses: CWE-557

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-21806 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.