Zero Radar
← feed
CriticalVulnerabilityCVE-2026-108015updated 27 Oct 2026, 20:35 UTC

HCL Notes Client can be tricked into trusting fake servers

Attackers may be able to pose as real servers that HCL Notes Client connects to, and read or change the data sent between them. This is possible because some certificate authority private keys used to vouch for those servers were stolen.

Official, 2 sources
SeverityCriticalCVSS 9.1 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker obtains CA keysPrivate keys for eight intermediate CAs compromised
  2. 2Attacker positioned on networkSits between client and destination server
  3. 3Fake certificate createdSpoofed server cert signed with stolen key
  4. 4Notes Client trusts itOutbound TLS connection accepted as valid
  5. 5Traffic interceptedContent read or modified in transit
  6. ResultOutbound Notes traffic is intercepted or altered

What happened

Private keys for eight eMudhra intermediate CA certificates were compromised, undermining trust in certificates used by the outbound network request features of HCL Notes Client.

Why it is dangerous: An unauthenticated network attacker could spoof server certificates and perform man-in-the-middle attacks, intercepting or modifying outbound TLS traffic from affected clients.

Are you affected?

You are affected if you run HCL Notes Client with outbound network request features that rely on the compromised eMudhra intermediate CA certificates.

HCL Notes Client (versions unknown)

What to do

  1. Check the eMudhra advisory at https://emudhra.we-have-a-problem.com/ for details on the compromised certificates
  2. Check HCL's official channels for an updated HCL Notes Client version or mitigation and apply it when available
  3. Until a fix is confirmed, avoid sending sensitive data over outbound connections from HCL Notes Client on untrusted networks

Timeline

  1. 27 Oct 2026, 17:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 17:16 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 17:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 20:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-108015 · GHSA-m39m-j83g-9vrj
CVSS
9.1 / 10
EPSS
0.1% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 17:16 UTC
On Zero Radar
27 Oct 2026, 17:20 UTC (4 min after disclosure)
Last change
27 Oct 2026, 20:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

HCL Notes Client can be tricked into trusting fake servers · Zero Radar