HCL BigFix SaaS Remediate Missing Security Headers Vulnerability

A vulnerability exists in HCL BigFix SaaS Remediate due to HTTP responses lacking essential security headers. This omission compromises the application's client-side security, increasing susceptibility to common web threats such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.

Impact

The absence of security headers in HTTP responses weakens the application's defense against various web attacks, potentially allowing for Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.

Remediation

The missing HTTP security headers have been added for all load balancers in the production environment. The fix was implemented on October 24, 2025.