CVE-2026-56608 describes a missing access control vulnerability (CWE-284) in HCL iControl version 3.2.0. The application fails to enforce proper granular access controls, enabling unauthorized users to access or view administrator-level features without appropriate authorization. The vulnerability is remotely exploitable without privileges or user interaction but requires high attack complexity. The CVSS 3.1 base score is 3.7, reflecting low confidentiality impact and no integrity or availability impact.

Unauthorized users may gain access to administrator-level functionalities, potentially exposing sensitive administrative interfaces or information. However, the impact on confidentiality is limited (low), and there is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published by HCL Software as of the current information. Users should monitor vendor communications for updates and apply any future patches promptly.