Medium severity · published Jan 7, 2026
CVE-2025-31962
HCL BigFix IVR is impacted by an insufficient session expiration vulnerability
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
BigFix IVR · HCLSoftware
4.2 · source: vendor
BI
Bigfix Insights For Vulnerability Remediation · Hcltech
4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-31962
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-31962
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753
More from BigFix IVR
4.9
CVE-2025-31964
HCL BigFix IVR is impacted by an improper service binding configuration
3.3
CVE-2025-31963
HCL BigFix IVR is impacted by improper authentication and missing CSRF protection