HCL iControl EUVD-2026-90814

Exploitation requires the iControl application to serve an insecure CORS response that reflects/over-permits arbitrary origins while setting Access-Control-Allow-Credentials, AND the victim must have an active, authenticated iControl session in their browser, AND the victim must be lured to an attacker-controlled web page during that session. Limiting factors: it is a browser/session-bound attack (not a direct server-side compromise), it yields only confidentiality impact (read/exfiltration, no modification), it depends on the victim being authenticated at exploit time, and it effectively requires user interaction (visiting the malicious site). No server-side authentication by the attacker is needed.

This is a genuinely low-severity issue (CVSS 4.3), and the available signals are consistent with that. The vendor CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) yields only low confidentiality impact with no integrity or availability effect. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided - exploitation status is 'no public exploit identified at time of analysis.' Importantly, there is a modeling discrepancy in the vector that affects how the risk reads: this is a classic credentialed-CORS attack where a malicious website rides the victim's active session, which conventionally scores as PR:N (the attacker holds no privileges) plus UI:R (the victim must visit the attacker-controlled page). The vendor instead encoded the authenticated-session precondition as PR:L and marked UI:N; either way the base score lands around 4.3, but the UI:N choice understates the real-world gating - successful exploitation requires luring an already-authenticated victim to a malicious page, which is a meaningful barrier. CWE is listed as N/A but the behavior is textbook CWE-942 (overly permissive cross-domain policy) / CWE-346 (origin validation error). Net: a real but low-priority weakness, not a high-CVSS-but-overstated issue - it is correctly rated low and is not an urgent patch.

An attacker hosts a malicious web page and lures a user who is currently logged into HCL iControl to visit it. Because iControl's CORS policy reflects or over-permits arbitrary origins while allowing credentials, the attacker's JavaScript issues cross-origin requests that carry the victim's session cookies, reads the authenticated responses, and exfiltrates sensitive data to an attacker-controlled server. No public exploit code is identified at time of analysis.