CVE-2026-56609

HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).

HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack modern security features, making them vulnerable to known attacks and exposing sensitive information during data transmission.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Icontrol

CVE-2026-56567

HCL iControl is affected by multiple security vulnerabilities.

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.

CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Icontrol

CVE-2026-56568

HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and authentication status

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Icontrol

CVE-2026-56569

HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Icontrol

CVE-2026-56570

HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Icontrol

CVE-2026-56571

HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Icontrol

CVE-2026-21840

HCL BigFix Platform is affected by a user enumeration vulnerability

HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Platform

CVE-2026-21770

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to DLL hijacking

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Traveler For Microsoft Outlook

CVE-2025-62347

Improper Input Validation Leading to Potential Security Bypass in HCL iControl

HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches the expected type.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Icontrol

CVE-2025-59866

Insecure File Permissions in HCL Software Installers Enable Privilege Escalation

The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfmpro For Catia Dfxanalytics Dfxserver

CVE-2026-35140

HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability

HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfxanalytics

CVE-2026-35141

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must implement a mechanism to include timestamps with every message, ensuring that messages exceeding a specific age threshold are automatically rejected by the recipient system.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfxanalytics

CVE-2026-35142

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability.

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfxanalytics

CVE-2026-35143

HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability.

HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.

CVSS 3.1 · 3 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfxanalytics

CVE-2026-35145

HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability.

HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfxanalytics

CVE-2026-56453

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability.

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfxanalytics

CVE-2026-56454

HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1.

HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1.0 and TLS 1.1, and exclusively enable support for secure protocols, specifically TLS 1.2 and TLS 1.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfxanalytics

CVE-2026-56455

HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS).

HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive. To mitigate this flaw, comprehensive input length checks must be implemented and enforced on both the client and server sides.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfxanalytics

CVE-2026-56456

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability.

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a remote attacker to map the underlying server environment and identify targets for further exploitation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Dfxanalytics

CVE-2026-56584

HCL IEM was affected with the Information disclosure nginx server

HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Intelliops Event Management