Quick answers
- Is CVE-2026-56460 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-56460 being exploited in the wild.
- How severe is CVE-2026-56460?
- Medium severity, with a CVSS score of 6.5, published 9 July 2026.
- Which products and versions are affected?
- HCL Software DevOps Deploy 7.3-7.3.2.18, 8.0-8.0.1.13, 8.1-8.1.2.6, 8.2-8.2.1.0; HCL Software DevOps Launch 7.3-7.3.2.18, 8.0-8.0.1.13, 8.1-8.1.2.6, 8.2-8.2.1.0.
- Is there a fix for CVE-2026-56460?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-56460 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-56460?
- Check whether you run HCL Software DevOps Deploy or HCL Software DevOps Launch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
HCL DevOps Deploy and HCL Launch are vulnerable to sensitive information disclosure (CWE-201) within API responses. The vulnerability allows an authenticated user with network access to the API to retrieve sensitive configuration details and secrets that should otherwise be protected. This occurs because the application fails to properly redact or filter sensitive data before sending it to the client. An attacker can leverage this information to facilitate further attacks against the deployment infrastructure. The issue affects multiple version branches including 7.3, 8.0, 8.1, and 8.2.
Affected products
- HCL Software DevOps Deploy / Launch 7.3-7.3.2.18, 8.0-8.0.1.13, 8.1-8.1.2.6, 8.2-8.2.1.0
Timeline
- 2026-07-09: disclosed: Initial publication of the CVE record