CVE-2026-66247: HCL iControl insecure CORS policy

CVE-2026-66247 · Severity: medium · CVSS 4.3 · Published 2026-10-01

iControl, an administrative interface for HCL products, has an insecure cross-origin resource sharing (CORS) policy that allows malicious websites to make authenticated requests on behalf of logged-in users. An attacker can craft a malicious website that, when visited by an iControl user, steals sensitive data from their active session without their knowledge.

Vendors: HCL.

Quick answers

Is CVE-2026-66247 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-66247 being exploited in the wild.
How severe is CVE-2026-66247?
Medium severity, with a CVSS score of 4.3, published 1 October 2026.
Which products and versions are affected?
HCL iControl.
Is there a fix for CVE-2026-66247?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-66247 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-66247?
Check whether you run HCL iControl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insecure CORS policy implementation in iControl that permits cross-origin requests with credentials. An attacker can exploit this via a malicious website visited by an authenticated iControl user, leveraging the victim's session credentials to exfiltrate sensitive data. The attack requires user interaction (visiting a malicious site) and an active authenticated session.

Affected products

  • HCL iControl

Timeline

  • 2026-10-01: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.