CVE-2026-66246
Received Received - Intake

Broken Access Control in HCL iControl

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: HCL Software

Description
iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-66246
EUVD
EUVD-2026-90813

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-250 The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Access Control issue in iControl. It occurs when authentication checks are missing or improperly implemented, allowing attackers to exploit insecure direct object references (IDOR). This can lead to privilege escalation and unauthorized changes or deletion of sensitive application data.

Impact Analysis

An attacker could gain elevated privileges, modify or delete critical data, or access restricted functions. This may disrupt services, cause data loss, or lead to further security breaches depending on the system's role and data sensitivity.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access or modification of protected data. GDPR and HIPAA mandate strict access controls and data protection; such breaches may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply vendor patches or updates for iControl immediately. Review and enforce strict access controls to prevent unauthorized modifications. Monitor logs for suspicious activity related to privilege escalation or data tampering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66246. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart