HCL MyCloud Vulnerability Advisory: Cookie Path, LUCKY13, IIS, and License Key Leakage

Vulnerability Overview HCL MyCloud has multiple security vulnerabilities, specifically including: 1. CVE-2026-56581 - Description: HCL MyCloud has a missing attribute for cookies, which may increase the risk of unauthorized access to session data or authentication tokens. - CVSS Base Score: 2.6 - CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N 2. CVE-2026-56582 - Description: HCL MyCloud uses the SSL/TLS protocol, which is vulnerable to the LUCKY13 issue. Attackers could potentially exploit this vulnerability to decrypt sensitive information via TLS/SSL padding oracle attacks. - CVSS Base Score: 3.1 - CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N 3. CVE-2026-56580 - Description: HCL MyCloud uses components (IIS server) with known vulnerabilities, potentially allowing attackers to exploit publicly disclosed weaknesses and compromise the system. - CVSS Base Score: 2.2 - CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N 4. CVE-2026-56579 - Description: HCL MyCloud leaks license keys in HTTP responses, which may allow attackers to abuse the leaked information and compromise the application's security. Affected Scope CVE-2026-56581: May increase the risk of unauthorized access to session data or authentication tokens. CVE-2026-56582: May allow sensitive information to be decrypted via TLS/SSL padding oracle attacks. CVE-2026-56580: May allow attackers to exploit components (IIS server) with known vulnerabilities to compromise the system. CVE-2026-56579: May allow attackers to abuse leaked license keys to compromise the application's security. Remediation CVE-2026-56581: Set the Cookie attribute. CVE-2026-56582: Remediate the SSL/TLS protocol vulnerability related to LUCKY13. CVE-2026-56580: Update or replace components with known vulnerabilities (IIS server). CVE-2026-56579: Prevent license keys from leaking in HTTP responses. Proof-of-Concept (POC) Code or Exploit Code No specific POC code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

HCL MyCloud Vulnerability Advisory: Cookie Path, LUCKY13, IIS, and License Key Leakage