Vulnerability · Published Oct 27, 2026 · Assigned by HCL

CVE-2026-108014eMudhra Compromised Certificate vulnerability impacts HCL Domino Server

Critical 9.1

In plain English

A critical-severity broken cryptography in Domino Server from HCLSoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 4.0)9.1Critical

Exploit odds (30 days)0.1%top 97.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.

Affected products (as reported)

Vendor	Product	Versions
HCLSoftware	Domino Server	<1=2.0.2 FP8, <=14.0 FP5, 14.5, <=14.5.1 FP1

Weakness: CWE-327 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134742