CVE-2026-56568 PUBLISHED

HCL iControl is affected by multiple security vulnerabilities.

Assigner: HCL
Reserved: 22.06.2026 Published: 31.07.2026 Updated: 31.07.2026

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and authentication status

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.7

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	HCL Software
Product	HCL iControl
Versions	Default: unaffected Version 4.3.0 and 4.4.0 is affected

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395

Problem Types

CWE-209 Generation of Error Message Containing Sensitive Information CWE