CVE-2026-66246

{
  "etk_id": "ETK-2026-244",
  "cve_id": "CVE-2026-66246",
  "display_id": "CVE-2026-66246",
  "ghsa_id": "GHSA-3hwm-64f6-4634",
  "euvd_id": "EUVD-2026-90813",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Broken access control in iControl",
  "summary": "iControl deployments may fail to enforce authorization checks for some application resources. An attacker able to reach an affected interface could gain elevated privileges or change or remove sensitive application data where those checks are missing.",
  "mitigation": "Restrict iControl access to trusted, authenticated users and networks, and apply least-privilege permissions. Monitor HCL updates and apply a vendor-provided fix when one is released; no fixed version is recorded.",
  "vendor": "HCL Software",
  "product": "iControl",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "v4.5.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "iControl",
      "purl": null
    }
  ],
  "cwes": [
    250
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.003,
  "epss_percentile": 0.2179,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.236797033333332,
  "t0_at": "2026-10-01T13:23:25.586000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T13:23:25.586000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-01T13:23:25.586000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66246"
    }
  }
}