HCL MyCloud EUVD-2026-46342

Exploitation requires an active authenticated session with at least low-privilege access to HCL MyCloud (PR:L per CVSS vector) - unauthenticated attackers cannot exploit this. The CVSS AC:H rating indicates that specific conditions beyond authentication must be met to trigger the response containing the license key, likely requiring knowledge of or access to a particular endpoint, workflow step, or application state. The application must be reachable over the network (AV:N). Scope is unchanged (S:U), meaning a successful attacker cannot directly leverage the license key to pivot into other systems or escalate beyond the HCL licensing context. Integrity and availability are unaffected. The key limiting factors are the authentication prerequisite and the high attack complexity, which together substantially reduce realistic exploitation risk compared to the network-accessible exposure surface.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) scores this at 3.1 (Low), and the signal set corroborates a genuinely low-priority issue. Attack complexity is rated High (AC:H), meaning exploitation is not trivially repeatable and requires specific conditions - likely triggering or intercepting a particular HTTP response path - beyond merely being authenticated. The privilege requirement (PR:L) confirms that unauthenticated exploitation is not possible. The confidentiality impact is limited (C:L) to the license key itself; there is no integrity or availability impact (I:N/A:N) and no scope change (S:U). No EPSS data is available for this CVE, the issue does not appear in the CISA KEV catalog, and no public exploit code has been identified. The primary real-world consequence is license abuse or unauthorized activation of HCL software, not direct system compromise. This is a compliance and licensing integrity concern rather than an exploitation-priority vulnerability.

An authenticated low-privilege user logs into HCL MyCloud and, using a browser proxy tool such as Burp Suite or browser developer tools, captures HTTP responses during normal application interaction. A specific response - likely from a settings, licensing, or status endpoint - returns the product license key in plaintext. The user extracts the key and uses it to activate an unauthorized instance of HCL MyCloud or a related HCL product, bypassing licensing costs without public exploit tooling.