HCL Notes Client EUVD-2026-111218

Exploitation requires two concrete preconditions: (1) the attacker must hold an on-path/man-in-the-middle position on the Notes Client's outbound network path (the AT:P attack requirement - e.g., control of a network segment, rogue access point, or traffic redirection), and (2) one or more of the eight compromised eMudhra intermediate CA certificates must still be present and trusted in the client's certificate trust chain used for outbound TLS. No authentication is needed (PR:N) and no user interaction is required (UI:N). Limiting factors: exploitation is not possible from an arbitrary remote host without the on-path position, and applying the vendor update (HCL KB0134749), which removes trust in the compromised CAs, closes the vector; the version data supplied is garbled and must be confirmed against the HCL advisory.

The source assigns CVSS 9.1 (4.0) and a vuln.today decision label of act_now, both signaling high priority, and the vector's AV:N/PR:N/UI:N confirms a remote, unauthenticated, no-interaction flaw with high confidentiality and integrity impact (VC:H/VI:H). However, the vector also carries AT:P - an attack requirement - which reflects that the attacker must achieve an on-path/man-in-the-middle position for the compromised eMudhra intermediate CA certificates to be abused; this is a meaningful real-world constraint that the headline 9.1 obscures. No EPSS score is provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no verified public exploit, so this is not confirmed active exploitation; the trust-chain nature of the flaw favors targeted interception over opportunistic mass exploitation. A vendor patch is available (HCL KB0134749). Net: a genuinely serious, patch-now issue per the vendor and decision framework, but its practical exploitation depends on the attacker already controlling or intercepting network traffic rather than on a directly reachable service, so prioritize the patch while recognizing the on-path precondition limits spray-and-pray abuse. Note the 'emudhra.we-have-a-problem.com' URL in the description is a placeholder/non-authoritative domain, not a verified intelligence source or PoC.

An attacker who can intercept a Notes Client's outbound network traffic (e.g., on a shared/compromised network, rogue Wi-Fi, or via DNS/BGP redirection) presents a TLS server certificate signed by one of the eight compromised eMudhra intermediate CAs. Because the Notes Client still trusts that chain, the spoofed certificate is accepted and the attacker transparently intercepts and/or modifies the content of the client's outbound TLS connections. No public exploit identified at time of analysis; exploitation requires the attacker to first obtain an on-path position (reflected by AT:P).