HCL iControl EUVD-2026-51544

Exploitation requires the attacker to have access to a browser on a shared workstation or device that a legitimate HCL iControl user previously used to authenticate. The browser must have autocomplete enabled - the default state in most browsers. The vulnerability exposes only usernames, email addresses, and account identifiers; it does not expose passwords, session tokens, or other high-value credentials. Exploitation is further limited to HCL iControl versions 4.3.0 and 4.4.0 specifically. The AC:H CVSS rating captures the requirement for this shared-environment precondition. Dedicated single-user workstations are not meaningfully at risk.

The CVSS 3.7 score (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately represents a low-priority, context-dependent risk. AC:H is the critical moderating factor - exploitation is not achievable against arbitrary targets but requires the attacker to have access to a shared browser session previously used to authenticate to HCL iControl. No EPSS data was supplied, so exploitation probability cannot be quantified independently. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified at time of analysis. Real-world risk is limited to environments where HCL iControl is accessed from shared or kiosk workstations with default browser settings. Dedicated, single-user enterprise deployments - which represent the typical use case for this class of product - face negligible practical risk. The integrity and availability scores of N confirm there is no path to data modification or service disruption via this flaw.

An attacker gains physical or logical access to a shared workstation where a previous user authenticated to HCL iControl 4.3.0 or 4.4.0 via a browser with autocomplete enabled. When the attacker navigates to the iControl login page, the browser suggests previously entered usernames or email addresses, allowing the attacker to enumerate valid account identifiers without any credentials. No public exploit code is known to exist for this issue.