EUVD-2026-46343
GHSA-734q-fxqq-j3r7
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Network-accessible IIS component but PR:H and AC:H reflect mandatory admin credentials and complex exploitation path; only limited confidentiality impact applies.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system.
AnalysisAI
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-1104 (Use of Unmaintained Third-Party Components). The CVSS 2.2 score (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects an extremely constrained attack surface: only a highly privileged attacker navigating high complexity can achieve limited confidentiality disclosure. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
CWE-1104 identifies the root cause as use of unmaintained or unpatched third-party components - in this case, Microsoft IIS (Internet Information Services) bundled within HCL MyCloud without being updated to a version free of publicly known weaknesses. IIS is a Windows-native web server; publicly disclosed IIS vulnerabilities span request parsing, authentication bypass, and information leakage classes depending on the specific unpatched CVE(s) present. The CPE cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:* covers all MyCloud versions without a fixed upper bound, indicating HCL has not scoped an explicit version boundary from available data. The specific IIS version bundled and the upstream CVE(s) it contains are not disclosed in available intelligence, which limits precise technical scoping.
RemediationAI
Apply guidance from the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132381, which should identify the specific IIS component update or MyCloud release that resolves the bundled vulnerability. No exact patched version is independently confirmable from available data - consult the advisory directly. As a compensating control pending patch, restrict access to the IIS-exposed MyCloud endpoints to the minimum set of administrative accounts necessary, consistent with the PR:H exploitation prerequisite. Disable unused IIS features, modules, and virtual directories to reduce the exploitable surface area exposed by the vulnerable component. IP allowlisting of MyCloud management interfaces is a low-trade-off control that meaningfully raises attacker complexity beyond the already-high AC:H baseline.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing at
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercep
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessio
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication token
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or applicat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today