Medium severity · published Jun 4, 2026
CVE-2025-52608
HCL iControl was affected by Missing Cookie Attributes vulnerability.
4.3
CVSS
0.1%
EPSS
No
On KEV
Description
HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
iControl · HCL
4.0.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52608
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52608
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131061
More from iControl
8.8
CVE-2025-52612
HCL iControl was affected by Export CSV - CSV Injection vulnerability.
5.3
CVE-2025-52609
HCL iControl was affected by Missing Security Headers vulnerability.
4.3
CVE-2025-52606
HCL iControl was affected by Weak Input Validation vulnerability. .
4.3
CVE-2025-52611
HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability