HCL iControl CVE-2026-56567

The vulnerability requires that HCL iControl version 4.3.0 or 4.4.0 is deployed with its web server or application layer insufficiently hardened - specifically, that internal configuration files are accessible via the web-serving layer without access controls blocking them. The vendor CVSS assignment of AV:L suggests local system access may be required to reach the exposed files, but the description's reference to 'public exposure' and 'improper web server hardening' implies the files may be accessible over the network from any client. No authentication is required per PR:N in the vendor CVSS vector. Exploitation is limited to products running the two confirmed affected versions (4.3.0, 4.4.0). The confidentiality impact is bounded by the contents of the exposed configuration files and does not in itself grant code execution.

The vendor-assigned CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) presents a notable discrepancy: AV:L (local attack vector) conflicts directly with the description of 'public exposure' via improper web server hardening, which implies network-reachable files. If the configuration files are truly publicly exposed over HTTP/S, the real-world attack vector is network, not local - which would substantially elevate risk. The low confidentiality (C:L) and integrity (I:L) scores suggest the vendor considers the exposed content limited in sensitivity, but configuration file contents can enable secondary attacks of much higher severity. EPSS data is not provided, and the absence of a KEV entry or confirmed POC suggests exploitation is not currently widespread. However, the low complexity (AC:L) and no-privilege-required (PR:N) ratings indicate that if a network path exists to the exposed files, exploitation requires no skill or setup. Defenders should verify whether the AV:L vendor assignment accurately reflects the actual exposure surface or whether the files are reachable over the network.

An unauthenticated attacker with network access to the HCL iControl web server - if the exposure is indeed network-reachable contrary to the AV:L assignment - crafts a direct HTTP GET request to a known or guessed configuration file path (e.g., /config/app.properties or /WEB-INF/web.xml). The server returns the file contents due to absent access controls, revealing credentials, internal service endpoints, or API keys that the attacker then uses to authenticate to backend systems or escalate privileges. No public exploit code is known to exist for this specific CVE.