What is the CVSS score of CVE-2026-56567?

CVE-2026-56567 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

HCL iControl CVE-2026-56567

EUVD-2026-51555 LOW

External Control of System or Configuration Setting (CWE-15)

2026-07-31 HCL

GHSA-rpq2-x2pg-4mxq

Information Disclosure Hcl Icontrol Hcl Software

3.3

CVSS 3.1 · NVD

Severity by source

Vendor (HCL) PRIMARY

MEDIUM

qualitative

NVD

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network vector assigned because 'public exposure via web server' implies remote reachability; integrity set to N as description indicates read-only file exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 14:52 NVD

MEDIUM LOW

CVSS changed

Aug 06, 2026 - 14:52 NVD

5.1 (MEDIUM) 3.3 (LOW)

Analysis Generated

Jul 31, 2026 - 16:22 vuln.today

DescriptionNVD

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.

AnalysisAI

HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or application hardening, mapping to CWE-15 (External Control of System or Configuration Setting). The misconfiguration allows attackers to retrieve sensitive configuration data that may contain credentials, internal paths, service endpoints, or other operational details usable for further lateral movement or privilege escalation. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at the time of analysis.

Technical ContextAI

CWE-15 (External Control of System or Configuration Setting) describes vulnerabilities where a product's configuration is influenced or exposed to parties outside the intended trust boundary. In this instance, HCL iControl - identified via CPE cpe:2.3:a:hcl_software:hcl_icontrol:*:*:*:*:*:*:*:* - fails to apply proper hardening controls on its web server or application layer, resulting in configuration files being accessible without appropriate access controls. Typical root causes include missing deny-all rules for sensitive directories, absence of authentication middleware on configuration endpoints, improper file permissions that allow the web process to serve otherwise restricted files, or failure to remove default or debug configuration files from production deployments. HCL iControl is an enterprise IT operations management product; its configuration files may contain API keys, database connection strings, LDAP credentials, or internal network topology that would significantly aid an attacker.

RemediationAI

Consult the HCL vendor advisory directly at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395 for the official patched release version; an exact fix version is not independently confirmed in the available data. As compensating controls pending patching: configure the web server to explicitly deny access to configuration file directories using deny-all rules (e.g., deny access to *.conf, *.xml, *.properties, *.json files outside publicly intended paths); remove or relocate sensitive configuration files outside the web root entirely; enforce authentication or IP allowlisting on any administrative or configuration endpoints exposed by the application. Review web server access logs for historical access to configuration file paths to identify potential prior exposure. Note that access restrictions via web server configuration do not remediate the underlying misconfiguration - only the vendor-supplied patch fully resolves the root cause.