HCLSoftware vulnerabilities
We track 14 vulnerabilities in HCLSoftware products across 11 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest HCLSoftware vulnerabilities
- 9.1 Critical severity
Notes Client: Use of a Broken or Risky Cryptographic Algorithm
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoo
- 9.1 Critical severity
Domino Server: Use of a Broken or Risky Cryptographic Algorithm
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could spo
- 7.5 High severity
HCL Hive: Use of Unmaintained Third Party Components
HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the system by exploiting publicly documented security flaws.
- 7.5 High severity
HCL Hive: Incorrect Default Permissions
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.
- 7.4 High severity
HCL Hive: Use of a Cryptographic Primitive with a Risky Implementation
HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached.
- 7.2 High severity
HCL Hive: Incorrect Privilege Assignment
HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.
- 8.8 High severity
Commerce: Incorrect Privilege Assignment
HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
- 7.5 High severity
HCL DevOps Deploy: Permissive Cross-domain Security Policy with Untrusted Domains
HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
- 7.8 High severity
Traveler for Microsoft Outlook: Use of Unmaintained Third Party Components
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly know
- 8.8 High severity
Digital Experience: Improper Neutralization of Special Elements used in an OS Command
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibl
- 8.3 High severity
BigFix SCM Reporting: Use of Unmaintained Third Party Components
The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. Since jQuery 1.x has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses and
- 8.2 High severity
BigFix Service Management (SM): Inconsistent Interpretation of HTTP Requests
HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsin
- 9.8 Critical severity
Velocity: Improper Restriction of Excessive Authentication Attempts
Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.
- 7.8 High severity
BigFix Platform: Incorrect Default Permissions
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions.