What is the CVSS score of CVE-2026-56571?

CVE-2026-56571 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

HCL iControl CVE-2026-56571

EUVD-2026-51546 MEDIUM

Error Message Information Leak (CWE-209)

2026-07-31 HCL

GHSA-996x-c459-hrff

Information Disclosure Hcl Icontrol Hcl Software

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (HCL) PRIMARY

LOW

qualitative

NVD

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

Network-reachable with no auth required, but high complexity to reliably trigger error states; impact limited to partial information disclosure with no integrity or availability consequence.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 05, 2026 - 15:07 NVD

LOW MEDIUM

CVSS changed

Aug 05, 2026 - 15:07 NVD

3.7 (LOW) 5.3 (MEDIUM)

Analysis Generated

Jul 31, 2026 - 16:20 vuln.today

DescriptionNVD

HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated.

AnalysisAI

Improper error handling in HCL iControl 4.3.0 and 4.4.0 exposes sensitive information through verbose error messages triggered by common fault conditions - out of memory events, null pointer exceptions, database unavailability, network timeouts, and system call failures. CWE-209 classifies this as generation of error messages containing sensitive information, meaning stack traces, internal paths, configuration data, or environment details may be disclosed to a network-accessible observer who can trigger or observe these fault states. CVSS scores this at 3.7 (Low), reflecting high attack complexity and limited confidentiality impact; no public exploit identified at time of analysis.

Technical ContextAI

CWE-209 (Generation of Error Message Containing Sensitive Information) describes a failure mode where application error handling returns diagnostic detail - stack traces, database connection strings, internal file paths, class names, or environment variables - that should never reach an external consumer. HCL iControl is a network-accessible application (AV:N per CVSS vector) where multiple runtime fault categories are improperly handled: memory exhaustion, null dereferences, OS-level call failures, database layer errors, and network layer timeouts. Each of these fault paths may produce a distinct error response containing internal implementation artifacts. The affected product is identified by CPE cpe:2.3:a:hcl_software:hcl_icontrol:*:*:*:*:*:*:*:* and confirmed affected versions are 4.3.0 and 4.4.0 per EUVD-2026-51546.

RemediationAI

Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395 for patch guidance; a specific patched release version is not confirmed in the available data, so the advisory should be treated as the authoritative source. As a compensating control while awaiting patch guidance, configure application-layer or web-gateway error handling to suppress or sanitize verbose error responses before they reach clients - replacing detailed exception output with generic error codes. Additionally, restrict network exposure of HCL iControl management interfaces to trusted internal segments or VPN-only access, which raises the effective attack complexity beyond the already-High AC rating. Enabling structured logging that captures fault details internally without exposing them externally (e.g., log-to-file rather than log-to-response) addresses the CWE-209 root cause directly. These controls reduce information leakage risk but do not substitute for the vendor patch.