Medium severity · published Jun 4, 2026
CVE-2025-52606
HCL iControl was affected by Weak Input Validation vulnerability. .
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
iControl · HCL
4.0.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52606
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52606
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131178
More from iControl
8.8
CVE-2025-52612
HCL iControl was affected by Export CSV - CSV Injection vulnerability.
5.3
CVE-2025-52609
HCL iControl was affected by Missing Security Headers vulnerability.
4.3
CVE-2025-52608
HCL iControl was affected by Missing Cookie Attributes vulnerability.
4.3
CVE-2025-52611
HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability