Medium severity · published Oct 16, 2025
CVE-2025-0276
HCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BM
BigFix Modern Client Management · HCL Software
<=3.3 · source: vendor, NVD
BM
Bigfix Mobile · Hcltech
through 3.3 · source: NVD
Affected product
BM
BigFix Modern Client Management
HCL Software
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0276
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0276
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124513
More from BigFix Modern Client Management
4.3
CVE-2025-0274
HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control