Executive brief
HCL MyCloud, a cloud management platform, was found to have a weak password policy. This flaw makes it easier for unauthorized individuals to gain access to user accounts through automated guessing or brute-force attacks. Successful exploitation could lead to unauthorized access to corporate cloud resources and potential data exposure.
Technical details
HCL MyCloud version 10.8.2 is vulnerable to CWE-521 (Weak Password Requirements). The application does not enforce sufficiently complex password policies, which reduces the entropy of user credentials. An attacker with network access could exploit this by performing brute-force or credential-stuffing attacks to compromise legitimate user accounts. The CVSS score of 3.1 reflects a low severity, as the attack complexity is high and requires some level of existing user privileges. Users are advised to refer to HCL security bulletin KB0132381 for remediation steps.
Affected products
- HCL Software MyCloud 10.8.2
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory