Man-in-the-Middle Attack Risk in HCL Notes Client Due to Compromised Intermediate CA Certificates
CVE-2026-108015

9.1CRITICAL

Key Information:

Vendor

HCL Softwaresoftware

Status
Notes Client
Vendor
CVE Published:
27 October 2026

What is CVE-2026-108015?

A security vulnerability arises from the compromise of private keys for eight eMudhra intermediate CA certificates, impacting the trust model for certificate validation in HCL Notes Client. This flaw allows an unauthenticated network attacker to spoof server certificates, which facilitates man-in-the-middle (MITM) attacks. As a result, the attacker could potentially intercept and alter the data transmitted over outbound TLS connections, posing a significant risk to data integrity and confidentiality.

Affected Version(s)

Notes Client <1=2.0.2 FP8, <=14.0 FP5, 14.5, ,<=14.5.1 FP1

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.