{"id":"CVE-2026-66249","aliases":[],"cve":{"records":[{"id":"CVE-2026-66249","source":"HCL","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-24T09:23:15.997Z","published":"2026-10-01T13:29:21.756Z","modified":"2026-11-09T16:31:30.813Z"}],"publishers":[{"name":"HCL","role":"CNA","organizationId":"1e47fe04-f25f-42fa-b674-36de2c5e3cfc","modified":"2026-10-01T13:29:21.756Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T16:31:30.813Z"}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133940","tags":[],"source":"HCL"}],"weaknesses":[{"id":"CWE-614","description":"CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute","source":"HCL"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-01T15:07:20.554380Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"HCL iControl is affected by a Missing Secure Attribute vulnerability","titleSource":"HCL","descriptionSource":"HCL","description":"iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers.","score":3.1,"severity":"low","published":"2026-10-01T13:29:21.756Z","modified":"2026-11-09T16:31:30.813Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"HCL Software","name":"iControl","platforms":[],"versions":[{"version":"v4.5.0","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"HCL","url":"https://www.cve.org/CVERecord?id=CVE-2026-66249"}],"remediation":[],"references":["https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133940"],"sources":[{"name":"CVE","id":"CVE-2026-66249","modified":"2026-11-09T16:31:30.813Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-66249"}],"assessments":[{"source":"HCL","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.1}],"sourceAffected":[],"observedAt":"2026-11-09T16:40:57.600Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:20:35.359Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T16:55:35.721Z","attemptedAt":"2026-11-09T16:55:35.721Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T16:55:35.772Z","attemptedAt":"2026-11-09T16:55:35.772Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T16:55:35.382Z","attemptedAt":"2026-11-09T16:55:35.382Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T16:55:35.728Z","attemptedAt":"2026-11-09T16:55:35.728Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-90816","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90816","modified":"Oct 1, 2026, 1:29:21 PM","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-09T16:55:35.382Z"},{"source":"NVD","id":"CVE-2026-66249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66249","modified":"2026-10-01T15:07:27.747","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-09T16:55:35.721Z"},{"source":"FIRST EPSS","id":"CVE-2026-66249","url":"https://www.first.org/epss/","probability":0.00103,"percentile":0.00963,"date":"2026-11-09","checkedAt":"2026-11-09T16:55:35.728Z"},{"source":"GitHub Advisory Database","id":"GHSA-qxqf-pp67-v58v","url":"https://github.com/advisories/GHSA-qxqf-pp67-v58v","modified":"2026-10-01T15:30:49Z","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-09T16:55:35.772Z"}],"aiSummary":{"text":"HCL iControl v4.5.0 has a Missing Secure Attribute vulnerability, potentially allowing attackers to intercept cookies over unencrypted HTTP connections, extracting sensitive session information. Attackers need access to the HTTP connection. The impact is unauthorized extraction of sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-09T16:46:09.133Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-66249"}]}}