Low severity · published Oct 1, 2026
CVE-2026-66249
HCL iControl is affected by a Missing Secure Attribute vulnerability
3.1
CVSS
0.1%
EPSS
No
On KEV
Description
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
iControl · HCL Software
v4.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66249
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66249
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133940
More from iControl
8.8
CVE-2026-66246
HCL iControl is affected by multiple security vulnerabilities
5.3
CVE-2025-62340
HCL iControl was affected by Inadequate Session Timeout vulnerability
4.3
CVE-2026-66247
iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included…
3.1
CVE-2026-66253
HCL iControl is affected by a Session Timeout vulnerability
3.1
CVE-2026-66248
HCL iControl is affected by an Improper Error Handling vulnerability