HCL iControl CVE-2026-66253

Exploitation requires a specific sequence of real-world conditions rather than a default-config remote attack: (1) a legitimate user must authenticate to the HCL iControl application and then leave the session unattended or abandoned; (2) the session must not have expired, because iControl fails to enforce an adequate session timeout; and (3) the attacker must gain access to that live session - most realistically via a shared, unlocked, or physically accessible workstation or an unterminated browser session. These limiting factors (dependence on victim negligence, a narrow unexpired-session window reflected in AC:H, and no attacker-held credentials) substantially constrain practical risk. Note the vendor's AV:N (network) claim overstates reach; the mechanism is better characterized as local/shared-workstation access.

This is a low-priority finding by every available signal. The vendor-assigned CVSS 3.1 score is only 3.1 (LOW), with impact limited to C:L/I:N/A:N and a high-complexity vector (AC:H) because exploitation depends on a victim leaving an authenticated session unattended while it remains unexpired. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept - no public exploit identified at time of analysis. The CWE-613 (Insufficient Session Expiration) root cause is a design weakness, not a directly remotely-triggerable flaw. One notable discrepancy: the vendor vector asserts AV:N (network), but the realistic exploitation path - riding an unattended/abandoned active session - is better described as local or shared-workstation access (closer to AV:L), so the network-vector claim should be treated cautiously. Additionally, the description states the attacker can 'perform actions on behalf of the victim,' which implies a low integrity impact (I:L) that the vendor's I:N rating omits; this would raise the true score slightly to roughly 4.2 but keep it firmly LOW. Overall this is a genuinely low-real-risk issue, not a high-CVSS-but-overstated one.

A user authenticates to the HCL iControl web application and walks away without logging out, leaving the session active on a shared or unlocked workstation. Because the session does not expire within a safe window, an attacker who reaches that still-valid session reuses it to access the application and perform actions as the victim. No public exploit code is required or available - the attack is opportunistic reuse of a live session.