CVE-2026-56609: HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).
HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack modern security features, making them vulnerable to known attacks and exposing sensitive information during data transmission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update HCL iControl to stop using weak TLS versions by disabling TLS 1.0 and TLS 1.1, so only modern TLS versions are enabled (the material specifically notes TLS 1.0 and TLS 1.1 were in use).
HCL iControl TLS 1.0 and TLS 1.1 = Disable
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56609?
The severity of CVE-2026-56609 is rated as medium with a score of 4.8.
How do I fix CVE-2026-56609?
To fix CVE-2026-56609, upgrade HCL iControl to use TLS versions 1.2 or higher.
What vulnerabilities are associated with CVE-2026-56609?
CVE-2026-56609 is associated with multiple vulnerabilities, specifically CVE-2026-56608 and CVE-2026-56609 itself.
What impact does CVE-2026-56609 have on HCL iControl?
CVE-2026-56609 poses a risk by allowing the use of weak TLS protocols, making the application susceptible to known attacks.
What should be done if using HCL iControl with version 1.0 or 1.1?
If using HCL iControl with TLS versions 1.0 or 1.1, it is essential to upgrade to a more secure version of TLS to mitigate the risks.