CVE-2026-66253
Received Received - Intake

Session Timeout Bypass in HCL iControl

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: HCL Software

Description
iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of the victim.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-66253
EUVD
EUVD-2026-90817

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Session Timeout issue in iControl that allows an attacker to exploit an unattended or abandoned active session. It enables unauthorized access to the application and lets the attacker perform actions as the victim.

Impact Analysis

If you leave your session unattended, an attacker could gain access to your account and perform actions without your permission. This could lead to data theft, unauthorized changes, or other malicious activities.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Enable session timeout policies to automatically log out inactive users. Regularly monitor active sessions and terminate any unattended ones. Ensure strong session management practices are enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66253. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart