Domino Server
Monthly
HCL Domino Server's outbound TLS client trust accepts certificates chaining to eight eMudhra intermediate CAs whose private keys have been compromised, so an attacker holding a forged server certificate signed by one of those keys can impersonate outbound HTTPS/TLS destinations and intercept or modify Domino's outbound traffic. Affected builds are 2.0.2 FP8, 14.0 through 14.0 FP5, 14.5 and up to 14.5.1 FP1; the CVSS 4.0 base score is 9.1, and the independently assessed 3.1 vector is AV:N/AC:H/PR:N/UI:N with high confidentiality and integrity impact and no availability impact, reflecting that a man-in-the-middle position on the outbound connection path is a prerequisite. No public exploit code was identified at time of analysis, but HCL has issued a vendor fix and the vuln.today decision label is act_now, making this a near-term patching priority.
HCL Domino Server's outbound TLS client trust accepts certificates chaining to eight eMudhra intermediate CAs whose private keys have been compromised, so an attacker holding a forged server certificate signed by one of those keys can impersonate outbound HTTPS/TLS destinations and intercept or modify Domino's outbound traffic. Affected builds are 2.0.2 FP8, 14.0 through 14.0 FP5, 14.5 and up to 14.5.1 FP1; the CVSS 4.0 base score is 9.1, and the independently assessed 3.1 vector is AV:N/AC:H/PR:N/UI:N with high confidentiality and integrity impact and no availability impact, reflecting that a man-in-the-middle position on the outbound connection path is a prerequisite. No public exploit code was identified at time of analysis, but HCL has issued a vendor fix and the vuln.today decision label is act_now, making this a near-term patching priority.