What is the CVSS score of CVE-2026-56577?

CVE-2026-56577 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

HCL MyCloud CVE-2026-56577

EUVD-2026-46340 MEDIUM

Weak Password Requirements (CWE-521)

2026-07-21 HCL

GHSA-hhgc-cpmc-3r4j

Brute Force Information Disclosure Mycloud

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (HCL) PRIMARY

LOW

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Brute-force against a login endpoint requires no prior privileges and low complexity; successful exploitation impacts confidentiality and integrity, not availability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 03, 2026 - 14:52 NVD

LOW MEDIUM

CVSS changed

Aug 03, 2026 - 14:52 NVD

3.1 (LOW) 6.5 (MEDIUM)

Analysis Generated

Jul 21, 2026 - 18:02 vuln.today

DescriptionNVD

HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks.

AnalysisAI

Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing attacks, potentially enabling unauthorized account takeover. The flaw is classified under CWE-521 (Weak Password Requirements), meaning the platform fails to enforce sufficient password strength constraints on users. Despite tags indicating Information Disclosure risk, no public exploit code or active exploitation has been identified at time of analysis, and the vendor-assigned CVSS score of 3.1 reflects a Low severity rating.

Technical ContextAI

CWE-521 (Weak Password Requirements) describes a class of weakness where a software product does not enforce adequate password strength policies - such as minimum length, character complexity, or restrictions on common/dictionary passwords. The affected product, HCL MyCloud (CPE: cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*), is a cloud-based collaboration platform developed by HCL Software. A lax password policy enables attackers to target accounts using automated brute-force tools or credential lists from prior breaches (credential stuffing), reducing the effort required to successfully authenticate as a legitimate user. The asterisk wildcard in the CPE version field indicates all known versions are potentially affected.

RemediationAI

Consult the HCL Software advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132381 for vendor-released guidance; an exact patched version is not independently confirmed from available data. As compensating controls, administrators should enforce a strong password policy at the platform or identity provider level - requiring minimum length (12+ characters), character complexity, and rejection of common/dictionary passwords. Enabling multi-factor authentication (MFA) is the highest-impact mitigation, as it renders brute-forced credentials alone insufficient for login; however, MFA may add friction for end users and requires rollout planning. Account lockout policies (e.g., lockout after 5-10 failed attempts) should be configured to throttle brute-force attempts, with the trade-off that overly aggressive lockout thresholds can enable denial-of-service against accounts. Credential monitoring via integration with breach databases (e.g., HaveIBeenPwned API) can detect compromised passwords proactively.