CVE-2026-56570 PUBLISHED

HCL iControl is affected by multiple security vulnerabilities.

Assigner: HCL
Reserved: 22.06.2026 Published: 31.07.2026 Updated: 31.07.2026

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 3.7

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	HCL Software
Product	HCL iControl
Versions	Default: unaffected Version 4.3.0 and 4.4.0 is affected

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395

Problem Types

CWE-522 Insufficiently Protected Credentials CWE