CVE-2026-108015
Received
Received - Intake
eMudhra CA Private Key Compromise Affects HCL Notes Client
Vulnerability report for CVE-2026-108015, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-27
Last updated on: 2026-10-27
Assigner: HCL Software
Description
Description
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| HCLSoftware | Notes Client | <1=2.0.2 FP8, <=14.0 FP5, 14.5, ,<=14.5.1 FP1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
