CVE-2026-56567 describes a security misconfiguration vulnerability in HCL iControl v4.3.0 where internal configuration files are publicly exposed due to insufficient web server or application hardening. This exposure can lead to unauthorized disclosure of configuration settings, potentially impacting confidentiality and integrity. The vulnerability is categorized under CWE-15 (External Control of System or Configuration Setting). The CVSS score of 5.1 reflects a medium severity with local attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability. No vendor advisory or patch information is currently available.

The vulnerability allows unauthorized users to access internal configuration files, potentially leading to disclosure of sensitive information and unauthorized modification of configuration settings. This can compromise the confidentiality and integrity of the affected system. There is no indication of impact on system availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or guidance is provided by HCL Software, organizations should review and strengthen web server and application hardening configurations to prevent public exposure of internal files. Monitoring and restricting access to configuration files is recommended as a precautionary measure.