HCL MyCloud EUVD-2026-46341

The CVSS vector (PR:H, AC:H) indicates exploitation requires a highly-privileged account within HCL MyCloud - such as an administrative user - and additional high-complexity conditions that the vendor has not fully detailed in the advisory. The version disclosure is not a directly damaging action; it only becomes meaningful when an attacker already holds a privileged position and uses the version data to refine a subsequent attack. What limits exploitation: authentication at a high privilege level is mandatory per the vendor CVSS rating; attack complexity is high, implying non-trivial or conditional trigger requirements; the confidentiality impact is restricted to software version metadata only, with no data exfiltration, code execution, or service disruption possible through this weakness alone. UNCONFIRMED: Whether the disclosure is visible on pre-authentication endpoints - if so, the PR:H rating may understate the real exposure.

The CVSS 3.1 base score of 2.2 accurately reflects a very low immediate risk. The vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N is notable: despite network accessibility, both AC:H and PR:H dramatically narrow the exploitable population. High privilege (PR:H) implies the version disclosure is only observable by authenticated administrators or similarly privileged users, limiting the attacker surface considerably. No EPSS data was provided, precluding probabilistic exploitation likelihood comparison. There is no CISA KEV listing and no known proof-of-concept. The sole impact is minor confidentiality (C:L) - no integrity or availability risk. The realistic threat model is that a malicious insider or compromised privileged account uses version data to plan a more targeted follow-on attack. This is a hygiene and hardening issue, not an emergency patch priority. CAVEAT: the vendor's PR:H/AC:H rating deserves verification - typical HTTP header-based version disclosure is often observable without authentication; if the disclosure occurs on pre-authentication endpoints, the actual risk is materially higher than the CVSS score suggests.

A privileged authenticated user or compromised administrator account interacts with HCL MyCloud and observes the software version disclosed in HTTP response headers or application output during normal use. The attacker queries public vulnerability databases (NVD, ExploitDB) for CVEs targeting that specific version and selects a more impactful exploit to launch as a follow-on action. No public proof-of-concept for this specific disclosure vulnerability has been identified at time of analysis.