Vulnerability · Published Oct 27, 2026 · Assigned by HCL

CVE-2026-108015eMudhra Compromised Certificate vulnerability impacts HCL Notes Client

Critical 9.1

In plain English

A critical-severity broken cryptography in Notes Client from HCLSoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 4.0)9.1Critical

Exploit odds (30 days)0.1%top 97.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.

Affected products (as reported)

Vendor	Product	Versions
HCLSoftware	Notes Client	<1=2.0.2 FP8, <=14.0 FP5, 14.5, <=14.5.1 FP1

Weakness: CWE-327 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134749