HCL iControl CVE-2026-66248

Exploitation requires a network-reachable HCL iControl instance that returns verbose database/system error output when it encounters unhandled input (CWE-209). The vendor CVSS encodes AC:H, indicating the attacker must craft specific conditions to reliably induce the detailed error disclosure rather than it occurring on any trivial request, which limits reliability. There is a privilege ambiguity: the CVSS vector requires low privilege (PR:L), implying a valid/low-level account, while the description claims the attacker is unauthenticated - defenders should confirm which applies in their deployment. Impact is limited to disclosure of internal infrastructure details (C:L); there is no integrity or availability effect and no user interaction needed (UI:N).

This is a genuinely low-priority issue by every available signal. The vendor (HCL) CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N scores 3.1 (LOW): network-reachable but with high attack complexity, requiring some privilege, and yielding only a limited confidentiality impact (C:L) with no integrity or availability effect. The impact is purely informational - verbose database/system error messages leaking internal infrastructure details (CWE-209), which is reconnaissance value rather than direct compromise. There is a notable conflict in the source data: the Description states the attacker is 'unauthenticated,' yet the CVSS vector encodes PR:L (requires low privilege) - this should be verified with HCL, as it changes who can exploit it. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization. SSVC-wise this reads as low technical impact and not automatable in any damaging sense. Net: a real but minor information-disclosure finding whose chief danger is enabling a later, separate attack - not a standalone priority.

An attacker probes an internet-reachable HCL iControl endpoint with malformed or unexpected input to induce application errors, and the server returns verbose database/system error messages (stack traces, query fragments, host/path details). The attacker harvests these leaked internal infrastructure details to map the backend and plan a more targeted follow-on attack. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means reliable triggering may require specific crafted conditions.