HCL Domino CVE-2026-108014

The required precondition is an active man-in-the-middle position on the HCL Domino Server's OUTBOUND TLS connections (the 'outbound network request features'); the attacker must be able to intercept or redirect that traffic, which is exactly what CVSS 4.0 AT:P encodes. The enabling defect is that Domino's certificate trust still accepts certificates chaining to any of the eight compromised eMudhra intermediate CAs, so the attacker needs a forged server certificate signed with one of those leaked intermediate private keys. LIMITING FACTORS: exploitation is not possible without first achieving the network interception/positioning (so it is not purely opportunistic despite PR:N/UI:N), and it applies to outbound connections from affected Domino versions (2.0.2 FP8, ≤14.0 FP5, 14.5, ≤14.5.1 FP1); the complete fix is applying the vendor update that removes trust in the compromised CAs.

Raw severity is high (CVSS 4.0 base 9.1, AV:N/PR:N/UI:N with VC:H and VI:H), and the vuln.today decision label is act_now with a vendor patch available, so this should be treated as a near-term priority rather than a paper tiger. However, the single most important modifier is AT:P (attack requirement present): the CVSS 4.0 vector itself encodes that exploitation depends on the attacker first achieving an on-path/man-in-the-middle position to intercept Domino's outbound TLS traffic - it is not a direct remote-code or direct-data-exfil bug. That lowers real-world likelihood relative to the 9.1 headline, favoring an attacker already positioned on the network path (e.g., adjacent network, rogue infrastructure, or a compromised upstream) over opportunistic internet-wide exploitation. KEV status is not indicated in the input, so there is no confirmed active exploitation (confirmed actively exploited is NOT claimed here). No EPSS score was provided, so probabilistic exploitation likelihood cannot be compared against the KEV/decision signals - this is a genuine data gap. No SSVC exploitation/automatable/technical-impact triplet was supplied beyond the act_now label. Technical impact is high for confidentiality and integrity of outbound connections but the signals are not conflicting so much as incomplete: act_now + patch-available + AT:P together read as 'patch promptly, but widespread automated mass-exploitation is constrained by the MITM positioning requirement.'

An attacker already able to observe or redirect a Domino server's outbound TLS traffic (adjacent network, rogue Wi-Fi/router, DNS or BGP redirection, or compromised upstream link) presents a forged server certificate signed by one of the eight compromised eMudhra intermediate CA private keys, which Domino still trusts. Because the certificate chain validates, Domino establishes the connection to the attacker, who can then intercept and/or modify the content of that outbound TLS session. No public exploit identified at time of analysis, and exploitation still requires the attacker to first obtain the man-in-the-middle position (CVSS AT:P).