CVE-2026-56570 describes a vulnerability in HCL iControl where autocomplete features in browsers can leak sensitive information including valid usernames, email addresses, and account identifiers. This occurs because autocomplete is enabled, and in shared environments, attackers may leverage browser suggestions to enumerate valid user credentials. The vulnerability is categorized as CWE-522 (Insufficiently Protected Credentials). No patch or official remediation level has been provided by the vendor at this time. The CVSS v3.1 base score is 3.7, indicating low severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability allows an attacker with access to a shared environment to potentially discover valid usernames and related account information via browser autocomplete suggestions. This exposure is limited to information disclosure and does not affect integrity or availability. The impact is considered low severity due to the requirement of physical or shared environment access and the limited scope of information disclosed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider disabling browser autocomplete features on login forms in shared environments to prevent leakage of sensitive information. No official remediation or temporary fix has been documented by the vendor.