HCL MyCloud EUVD-2026-46344

Exploitation requires the target to be an authenticated HCL MyCloud user (PR:L - a valid low-privilege session must exist). The attacker must engineer conditions meeting high attack complexity (AC:H), meaning specific circumstances beyond simple network access are necessary - such as positioning to observe cross-path requests or leveraging a co-located malicious resource. User interaction is required (UI:R), so the victim must actively make a request that causes the unscoped cookie to be transmitted to an unintended path. The limiting factors are substantial: no unauthenticated exploitation path exists, opportunistic scanning is not viable, and the confidentiality impact is bounded to low (partial session data exposure). Non-default attacker positioning is required.

The CVSS 2.6 (AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) accurately reflects a low-severity, difficult-to-exploit finding. High attack complexity (AC:H) indicates the attacker must engineer specific conditions beyond standard network access; required user interaction (UI:R) means passive exploitation is not viable; and low privileges required (PR:L) confirms the target must already be authenticated. The sole impact is low confidentiality - partial session data exposure - with no integrity or availability impact. No EPSS score was provided in the input data, which limits probabilistic exploitation forecasting. The vulnerability is not listed in CISA KEV, and no POC exploit is identified. SSVC analysis would place this firmly in the 'Track' category: no active exploitation, non-automatable, low technical impact. This is a hygiene-level finding appropriate for a scheduled patch cycle, not emergency response. It is not a high-CVSS-but-low-real-risk situation - it is genuinely low risk across all available signals.

An authenticated user of HCL MyCloud visits the application while an attacker is positioned to observe or intercept HTTP requests - for example, via a shared network or a malicious resource loaded from an unintended path. Because the session cookie lacks a Path restriction, the browser includes it in requests to paths beyond the intended application scope, where the attacker captures the token and potentially reuses it for session impersonation. High attack complexity and required user interaction make opportunistic mass exploitation unlikely.