What is the CVSS score of CVE-2026-56570?

CVE-2026-56570 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

HCL iControl CVE-2026-56570

EUVD-2026-51544 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-07-31 HCL

GHSA-96vv-6p9m-jpxr

Information Disclosure Hcl Icontrol Hcl Software

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (HCL) PRIMARY

LOW

qualitative

NVD

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

AV:N because the vulnerable component is a network-accessible web application; AC:H reflects the shared browser environment prerequisite; C:L for username and email disclosure only, no password or integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 05, 2026 - 14:37 NVD

LOW MEDIUM

CVSS changed

Aug 05, 2026 - 14:37 NVD

3.7 (LOW) 5.3 (MEDIUM)

Analysis Generated

Jul 31, 2026 - 16:21 vuln.today

DescriptionNVD

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.

AnalysisAI

HCL iControl versions 4.3.0 and 4.4.0 expose authentication-related sensitive data through browser autocomplete functionality on login forms, classified under CWE-522 (Insufficiently Protected Credentials). Valid usernames, email addresses used for login, and account identifiers can be surfaced by the browser's autocomplete engine to subsequent users on shared workstations or kiosk environments. No active exploitation has been identified at time of analysis, and the CVSS score of 3.7 accurately reflects a low-severity, opportunistic information disclosure issue rather than a remotely exploitable critical flaw.

Technical ContextAI

HCL iControl is an enterprise IT infrastructure management platform developed by HCL Software. The vulnerability stems from login form fields not carrying the HTML autocomplete='off' attribute or an equivalent suppression mechanism, causing standards-compliant browsers to cache and suggest previously submitted credential fields. CWE-522 (Insufficiently Protected Credentials) applies because the application fails to protect credential-adjacent data from being stored in an uncontrolled, browser-managed cache. The affected CPE is cpe:2.3:a:hcl_software:hcl_icontrol:*:*:*:*:*:*:*:*, with specific affected versions confirmed by EUVD-2026-51544 as 4.3.0 and 4.4.0. The weakness is at the web front-end layer, not in the server-side authentication logic.

RemediationAI

Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395 for the authoritative patch guidance; a patch is available per vendor advisory, though the exact fixed version number is not independently confirmed from available data. As a compensating control pending patching, restrict HCL iControl access to dedicated, single-user workstations and prohibit use on shared or kiosk systems. Browser policy controls (e.g., Group Policy on Windows to disable autocomplete, or browser extension enforcement) can suppress autocomplete at the client layer, though this does not address the root cause in the application. Educating users to manually clear browser-stored form data after sessions on shared machines provides additional mitigation with minimal operational impact.