CVE-2026-56458HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.

7.5 HIGHEPSS 0.26%Not in KEVNVD: Analyzed

Last updated: 2026-10-25 17:10 UTC

OverviewCVSS details

7.5HIGHCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: Jul 9, 2026
Assigner: HCL

Affected

HCL DevOps Deploy (HCLSoftware)

Versions: 8.1-8.1.2.6, 8.2-8.2.1.0

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable no · Impact partial

EPSS · FIRST, scored Nov 7

0.26%chance of exploitation in 30 days

Higher than 18.19% of CVEs

CVSS 3.1 · NVD

7.5High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: None
Availability impact: None

CVSS 3.1 · HCL (CNA)

5.4Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality impact: Low
Integrity impact: Low
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
7.5	HIGH	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5.4	MEDIUM	3.1HCL (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Details

CVE ID: CVE-2026-56458
Status: Analyzed
Assigner (CNA): HCL
Published: Jul 9, 2026
Last modified: 2026-10-25 17:10 UTC
Weaknesses: CWE-942 · Permissive cross-domain security policy with untrusted domains

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:24 UTC.