What is the CVSS score of CVE-2026-56568?

CVE-2026-56568 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

HCL iControl CVE-2026-56568

EUVD-2026-51542 MEDIUM

Error Message Information Leak (CWE-209)

2026-07-31 HCL

GHSA-rx7q-jfx2-p745

Information Disclosure Hcl Icontrol Hcl Software

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (HCL) PRIMARY

LOW

qualitative

NVD

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Network-accessible API, unauthenticated; AC:H because specific error-triggering request crafting is required; C:L for metadata-only disclosure with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 14:52 NVD

LOW MEDIUM

CVSS changed

Aug 06, 2026 - 14:52 NVD

3.7 (LOW) 5.3 (MEDIUM)

Analysis Generated

Jul 31, 2026 - 16:22 vuln.today

DescriptionNVD

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and authentication status

AnalysisAI

Verbose API error responses in HCL iControl 4.3.0 and 4.4.0 leak internal endpoint names, request parameters, error codes, and authentication status directly to unauthenticated network clients. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network-accessible, unauthenticated exposure but with high attack complexity - specific error-triggering conditions must be crafted. No public exploit exists and this is not in CISA KEV; however, the disclosed metadata constitutes meaningful reconnaissance leverage that can lower the cost of subsequent targeted attacks against the platform.

Technical ContextAI

HCL iControl is an enterprise management platform from HCL Software. Versions 4.3.0 and 4.4.0 (CPE: cpe:2.3:a:hcl_software:hcl_icontrol:*:*:*:*:*:*:*:*) are confirmed affected. The root cause is CWE-209 - Generation of Error Message Containing Sensitive Information - where the application's error-handling routines propagate raw server-side exception data directly into HTTP responses without sanitization or abstraction. This exposes internal implementation details including API endpoint paths, parameter names, internal error codes, and authentication state indicators. Such data is ordinarily invisible to clients and is expected to be replaced with generic HTTP error messages. The flaw sits at the client-server API boundary, suggesting insufficient separation between internal diagnostic logging and external response construction.

RemediationAI

Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395 for the patched release - the exact fixed version number is not specified in the available intelligence data and must be confirmed directly with HCL. As a compensating control where immediate patching is not feasible, deploy an API gateway or reverse proxy configured to intercept and replace verbose error responses with generic HTTP status messages (e.g., 500 Internal Server Error without body detail) before they reach external clients; note that this approach may suppress error details useful for client-side debugging and requires separate internal logging to preserve operational visibility. Additionally, restrict network-level access to HCL iControl API endpoints to trusted internal networks or VPN segments, reducing the attacker population that can trigger and observe error responses - this does not eliminate the flaw but substantially reduces exposure.