Hcltech Icontrol vulnerabilities

13 CVEs affecting Hcltech Icontrol, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-56609, published 2026-08-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-56568, published 2026-07-31. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of…
CVE-2026-56570, published 2026-07-31. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the…
CVE-2026-56571, published 2026-07-31. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of…
CVE-2026-56608, published 2026-08-03. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level…
CVE-2025-62340, published 2026-06-17. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period…
CVE-2025-52612, published 2026-06-04. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input…
CVE-2025-52606, published 2026-06-04. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain…
CVE-2025-52609, published 2026-06-04. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering mechanisms of modern web browsers.
CVE-2025-52611, published 2026-06-04. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code.…
CVE-2026-56609, published 2026-08-03. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack…

Latest

CVE-2026-56569, published 2026-07-31. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.
CVE-2026-56567, published 2026-07-31. Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days. HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.