What is the CVSS score of EUVD-2026-52261?

EUVD-2026-52261 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

HCL iControl EUVD-2026-52261

| CVE-2026-56609 MEDIUM

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-08-03 HCL

GHSA-h52c-m8x8-84gp

Information Disclosure Hcl Icontrol Hcl Software

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (HCL) PRIMARY

MEDIUM

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.8 MEDIUM

Network-reachable but requires MITM positioning (AC:H); no auth needed; limited confidentiality and integrity impact from protocol downgrade; no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 05, 2026 - 15:07 NVD

4.8 (MEDIUM) 6.5 (MEDIUM)

Analysis Generated

Aug 03, 2026 - 13:20 vuln.today

DescriptionNVD

HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack modern security features, making them vulnerable to known attacks and exposing sensitive information during data transmission.

AnalysisAI

HCL iControl v3.2.0 exposes sensitive data in transit by advertising support for deprecated TLS 1.0 and TLS 1.1 protocol versions, which lack modern cryptographic protections. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates a network-reachable flaw requiring high attack complexity - consistent with a man-in-the-middle positioning requirement for exploitation. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the medium-priority tier despite its network exposure, though organizations with regulatory requirements around cryptographic standards (PCI-DSS, NIST SP 800-52) should treat remediation as mandatory.

Technical ContextAI

CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) covers the root cause: HCL iControl v3.2.0 (CPE: cpe:2.3:a:hcl_software:hcl_icontrol:*:*:*:*:*:*:*:*) continues to negotiate TLS 1.0 and TLS 1.1 sessions, both of which were formally deprecated by RFC 8996 in March 2021. TLS 1.0 is susceptible to BEAST (Browser Exploit Against SSL/TLS) and POODLE attacks, while TLS 1.1 lacks support for AEAD cipher suites and modern elliptic-curve key exchange. These weaknesses allow a network adversary with MITM position to potentially decrypt or tamper with session data. The CPE wildcard on the version field suggests HCL has not narrowed the affected range beyond what EUVD separately identifies as v3.2.0.

RemediationAI

The primary remediation is to disable TLS 1.0 and TLS 1.1 in HCL iControl's server-side TLS configuration and restrict accepted protocols to TLS 1.2 (with strong cipher suites) and TLS 1.3. Refer to the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132564 for product-specific configuration steps, as no exact patched release version is independently confirmed in the available data. If a configuration-based fix is not yet available or practical, network-level compensating controls should be applied: place HCL iControl behind a TLS-terminating reverse proxy or load balancer configured to accept only TLS 1.2+ from clients, forwarding traffic internally - note this shifts the TLS policy enforcement upstream and introduces an additional hop to monitor. Restricting network access to HCL iControl to trusted internal segments or VPN reduces MITM attack surface in the interim. Organizations subject to PCI-DSS 4.0 or NIST SP 800-52 Rev. 2 should treat this as a compliance-blocking finding regardless of CVSS score.