{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2026-108015",
        "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
        "state": "PUBLISHED",
        "assignerShortName": "HCL",
        "dateReserved": "2026-10-09T09:26:54.337Z",
        "datePublished": "2026-10-27T16:53:19.893Z",
        "dateUpdated": "2026-10-27T20:29:23.260Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
                "shortName": "HCL",
                "dateUpdated": "2026-10-27T20:29:23.260Z"
            },
            "title": "eMudhra Compromised Certificate vulnerability impacts HCL Notes Client",
            "datePublic": "2026-10-27T16:53:00.000Z",
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "cweId": "CWE-327",
                            "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "HCLSoftware",
                    "product": "Notes Client",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "<1=2.0.2 FP8, <=14.0 FP5, 14.5, <=14.5.1 FP1"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "value": "Private keys for eight eMudhra intermediate CA certificates have been  compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client.  An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.",
                    "supportingMedia": [
                        {
                            "type": "text/html",
                            "base64": false,
                            "value": "Private keys for eight eMudhra intermediate CA certificates have been <a title=\"\" href=\"https://emudhra.we-have-a-problem.com/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">compromised</a>, which impacts certificate trust for outbound network request features of HCL Notes Client.&nbsp; An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections."
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134749"
                }
            ],
            "metrics": [
                {
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ],
                    "cvssV4_0": {
                        "attackVector": "NETWORK",
                        "attackComplexity": "LOW",
                        "attackRequirements": "PRESENT",
                        "privilegesRequired": "NONE",
                        "userInteraction": "NONE",
                        "vulnConfidentialityImpact": "HIGH",
                        "subConfidentialityImpact": "NONE",
                        "vulnIntegrityImpact": "HIGH",
                        "subIntegrityImpact": "NONE",
                        "vulnAvailabilityImpact": "NONE",
                        "subAvailabilityImpact": "NONE",
                        "exploitMaturity": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "valueDensity": "NOT_DEFINED",
                        "vulnerabilityResponseEffort": "NOT_DEFINED",
                        "providerUrgency": "NOT_DEFINED",
                        "version": "4.0",
                        "baseSeverity": "CRITICAL",
                        "baseScore": 9.1,
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
                    }
                }
            ],
            "source": {
                "discovery": "UNKNOWN"
            },
            "x_generator": {
                "engine": "Vulnogram 1.0.5"
            }
        }
    }
}