What is the CVSS score of CVE-2026-56459?

CVE-2026-56459 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

HCL DevOps Deploy CVE-2026-56459

EUVD-2026-42547 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-07-09 HCL

GHSA-8r3w-82fq-gwgp

Information Disclosure Hcl Devops Deploy Hcl Launch Hclsoftware

5.5

CVSS 3.1 · NVD

Severity by source

Vendor (HCL) PRIMARY

MEDIUM

qualitative

NVD

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.2 MEDIUM

Local attack vector with no privileges required, consistent with world-readable log files; high confidentiality only, no integrity or availability impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 10, 2026 - 16:07 NVD

6.2 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 09, 2026 - 10:06 vuln.today

DescriptionNVD

HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure. The application stores potentially sensitive information in log files that could be read by a local user.

AnalysisAI

Sensitive information disclosure in HCL DevOps Deploy / HCL Launch exposes credentials or operational data stored in application log files to any local user who can read those files. Affected across four major release branches (7.3, 8.0, 8.1, and 8.2), the vulnerability stems from CWE-532, where the application writes sensitive material into logs without adequate sanitization or access restriction. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog, but the high confidentiality impact (C:H) and zero-privilege local access condition elevate real-world concern in multi-tenant or shared-host deployments.

Technical ContextAI

HCL DevOps Deploy (formerly IBM UrbanCode Deploy) and its rebranded variant HCL Launch are enterprise continuous delivery automation platforms. The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File), a weakness where application log output inadvertently captures secrets such as credentials, API keys, tokens, or configuration parameters. The affected CPE is cpe:2.3:a:hclsoftware:hcl_devops_deploy_/_hcl_launch:*:*:*:*:*:*:*:* covering all matched versions across the 7.3, 8.0, 8.1, and 8.2 release lines. The CVSS vector AV:L/PR:N indicates the log files are accessible to local OS users without elevated privileges, suggesting file permissions on the log directory may be overly permissive.

RemediationAI

Consult the HCL vendor knowledge base article KB0131696 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131696 for official patch guidance; no exact fixed version number is confirmed in the available intelligence data, so the specific upgrade target must be verified directly with HCL. As compensating controls, restrict filesystem permissions on the application log directories to the minimum required service account, preventing OS-level users without explicit access from reading log content. Review existing log files for sensitive material and rotate any exposed credentials immediately. Consider enabling log forwarding to a centralized, access-controlled SIEM so that raw log files on the host are not retained longer than necessary. Each of these mitigations reduces exposure without requiring a patch but does not eliminate the root-cause logging behavior.