CVE-2026-66247 describes a vulnerability in HCL Software iControl 4.5.0 where an insecure CORS policy allows cross-origin requests with credentials. This misconfiguration could be exploited by a malicious website to access and exfiltrate sensitive data from the victim's session. The vulnerability is classified under CWE-942 (Improper Control of Generation of Code). The CVSS v3.1 base score is 4.3, reflecting a network attack vector with low privileges required and no user interaction needed, impacting confidentiality only.

An attacker controlling a malicious website could exploit the insecure CORS policy to perform cross-origin requests with credentials included, potentially accessing sensitive data from the victim's active session in iControl 4.5.0. The impact is limited to confidentiality loss without integrity or availability impact. No known exploits are reported in the wild.

No patch or official fix information is provided. Since the product is not a cloud service, remediation depends on vendor updates or configuration changes. Users should monitor the vendor advisory for patch availability and consider restricting CORS policies to trusted origins as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.