Critical severity · published Oct 27, 2026
CVE-2026-108015
eMudhra Compromised Certificate vulnerability impacts HCL Notes Client
New
9.1
CVSS
–
EPSS
No
On KEV
Description
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client.  An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
Notes Client · HCLSoftware
<1=2.0.2 FP8, <=14.0 FP5, 14.5, <=14.5.1 FP1 · source: vendor