CVE-2025-31955: HCL Software iAutomate · Information Exposure
Affects HCL Software iAutomateSource CVE Database V5
Not known to be exploited · CVSS 7.6 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 24 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| HCL Software iAutomate | Affected
| Fixed in– |
AI-suggested
Given the absence of an official patch at the time of disclosure, European organizations should implement the following specific mitigations: 1) Restrict network access to the iAutomate management interfaces by implementing strict firewall rules and network segmentation to limit exposure to trusted hosts only. 2) Enforce the principle of least privilege by reviewing and tightening user permissions within iAutomate to minimize the number of accounts with elevated privileges. 3) Enable and enhance logging and monitoring on iAutomate systems to detect unusual access patterns or data exfiltration attempts promptly. 4) Utilize encryption for data at rest and in transit within the iAutomate environment to reduce the risk of data exposure even if accessed. 5) Conduct regular security assessments and penetration testing focused on iAutomate deployments to identify and remediate configuration weaknesses. 6) Prepare an incident response plan specific to iAutomate-related data breaches, including communication protocols and containment strategies. 7) Stay informed on vendor updates and apply patches immediately once available. 8) Consider deploying web application firewalls (WAFs) or intrusion detection/prevention systems (IDS/IPS) with signatures or heuristics tailored to detect exploitation attempts targeting this vulnerability.
Description
HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system.