CVE-2026-66246 HIGH

CVE-2026-66246: HCL iControl is affected by multiple security vulnerabilities

Vendor Hcl Software
Product iControl
Weakness CWE-250
Published October 1, 2026
Last update October 1, 2026

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.

Key dates

02Disclosure timeline

October 1, 2026 CVE published
October 1, 2026 Record updated