CVE-2026-56608 HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).
Attackers can access administrator-level functionalities without proper authorization due to missing access controls in HCL iControl.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56608?
CVE-2026-56608 is a low-severity missing authorization vulnerability in HCL iControl, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization.
Weakness: CWE-284
Which versions are affected by CVE-2026-56608?
It affects 1 product.
Products include Hcltech Icontrol.
How do I fix CVE-2026-56608?
No fix has been published for CVE-2026-56608 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-56608 being exploited?
There is no known exploitation of CVE-2026-56608 in the wild and no public exploit code.
Other vulnerabilities in HCL iControl
- CVE-2025-52612 HCL iControl was affected by Export CSV - CSV Injection vulnerability.
- CVE-2026-56567 HCL iControl is affected by multiple security vulnerabilities.
- CVE-2026-56609 HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).
- CVE-2025-52606 HCL iControl was affected by Weak Input Validation vulnerability. .
- CVE-2026-56569 HCL iControl is affected by multiple security vulnerabilities.
Sources
Also known as GHSA-725p-7264-fgqq.