Zero Radar
← feed
CriticalVulnerabilityCVE-2026-108014updated 27 Oct 2026, 20:35 UTC

HCL Domino Server trust flaw lets attackers intercept encrypted connections

Attackers may be able to pretend to be trusted websites and read or change data sent by the server over supposedly secure connections. This happens because the private keys of some certificate authorities used to vouch for those sites were

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker obtains CA keyseMudhra intermediate CA private keys were compromised
  2. 2Attacker positioned on networkUnauthenticated attacker intercepts outbound traffic
  3. 3Server accepts spoofed certificateDomino trusts certificates chained to compromised CAs
  4. 4Traffic read or modifiedOutbound TLS connections intercepted and altered
  5. ResultEncrypted server traffic intercepted by attacker

What happened

Private keys for eight eMudhra intermediate CA certificates were compromised, which undermines certificate trust used by the outbound network request features of HCL Domino Server, enabling man-in-the-middle attacks.

Why it is dangerous: An unauthenticated network attacker could spoof server certificates and intercept or modify outbound TLS traffic from affected Domino servers, exposing data in transit.

Are you affected?

You are affected if you run HCL Domino Server with outbound network request features that rely on the compromised eMudhra intermediate CA certificates.

HCL Domino Server (versions not specified in the provided material)

What to do

  1. Check the eMudhra advisory at https://emudhra.we-have-a-problem.com/ for affected certificates
  2. Check the HCL Domino Server advisory for a fixed version or mitigation and apply it
  3. Review and restrict outbound network request features until a fix is confirmed

Timeline

  1. 27 Oct 2026, 17:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 17:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 17:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 20:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-108014 · GHSA-pq6c-vp8h-pgxw
CVSS
9.1 / 10
EPSS
0.1% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 17:16 UTC
On Zero Radar
27 Oct 2026, 17:20 UTC (4 min after disclosure)
Last change
27 Oct 2026, 20:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

HCL Domino Server trust flaw lets attackers intercept encrypted connections · Zero Radar