{"id":"CVE-2026-108015","kind":"vulnerability","aliases":["CVE-2026-108015"],"related":[],"title":"eMudhra intermediate CA private keys compromised, enabling TLS spoofing in HCL Notes","description":"Private keys for eight eMudhra intermediate CA certificates have been  compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client.  An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.","summary":"Private keys for eight eMudhra intermediate CA certificates have been compromised, so the certificates can no longer be trusted. An unauthenticated network attacker could use them to spoof server certificates and run a man-in-the-middle attack on outbound TLS connections from HCL Notes Client.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise-clients","hcl-notes","vendor","windows"],"not_affected_if":[],"how_to_check":"- Check whether HCL Notes Client is installed and which version runs, since the sources name no fixed version.\n- Check whether the trust store includes any of the eight eMudhra intermediate CA certificates; the sources do not list their identifiers, so unknown.","fix":"- Follow the vendor guidance at https://emudhra.we-have-a-problem.com/ and the HCL product advisory; the sources do not give a patched version or steps, so unknown.","status":"open","published_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:18+00:00","updated_at":"2026-10-27T17:34:18+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-27T17:34:18Z","model":"claude-haiku-5-5","output":{"fix":"- Follow the vendor guidance at https://emudhra.we-have-a-problem.com/ and the HCL product advisory; the sources do not give a patched version or steps, so unknown.","reach":"network","title":"eMudhra intermediate CA private keys compromised, enabling TLS spoofing in HCL Notes","impact":"high","summary":"Private keys for eight eMudhra intermediate CA certificates have been compromised, so the certificates can no longer be trusted. An unauthenticated network attacker could use them to spoof server certificates and run a man-in-the-middle attack on outbound TLS connections from HCL Notes Client.","category":"vendor","nicknames":[],"who_cares":["hcl-notes","windows","enterprise-clients"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker intercepts and modifies outbound TLS traffic from client","analyst_note":"Find the vendor advisory and the list of eight affected eMudhra intermediate CA certificates, plus the fixed HCL Notes Client version, at the URL https://emudhra.we-have-a-problem.com/ and the NVD entry.","how_to_check":"- Check whether HCL Notes Client is installed and which version runs, since the sources name no fixed version.\n- Check whether the trust store includes any of the eight eMudhra intermediate CA certificates; the sources do not list their identifiers, so unknown.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams that run HCL Notes Client and whose outbound network features trust eMudhra-issued certificates are affected, according to the description. The sources do not say which other systems rely on these intermediate CAs, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000645,"input_tokens":3342,"output_tokens":621,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-108015':15A,18A '-2026':14A,17A 'and/or':120C 'attack':49B,65B,102C,115C 'ca':3A,33B,80C 'certif':34B,40B,56B,81C,88C,106C 'client':21B,73B,98C 'compromis':6A,37B,84C 'connect':69B,127C 'content':123C 'could':50B,103C 'cve':13A,16A 'eight':30B,77C 'emudhra':1A,31B,78C 'emudhra.we-have-a-problem.com':85C 'enabl':7A,116C 'enterpris':20B 'enterprise-cli':19B 'execut':108C 'featur':94C 'hcl':11A,23B,71B,96C 'hcl-note':22B 'impact':87C 'intercept':119C 'intermedi':2A,32B,79C 'key':5A,28B,75C 'longer':43B 'man':61B,110C 'man-in-the-middl':60B 'middl':64B,113C 'mitm':114C 'modifi':121C 'network':48B,92C,101C 'note':12A,24B,72B,97C 'outbound':67B,91C,125C 'privat':4A,27B,74C 'request':93C 'run':58B 'server':55B,105C 'spoof':9A,54B,104C 'tls':8A,68B,126C 'trust':45B,89C 'unauthent':47B,100C 'use':51B 'vendor':25B 'window':26B","nicknames":[],"mitigations":[],"who_affected":"Teams that run HCL Notes Client and whose outbound network features trust eMudhra-issued certificates are affected, according to the description. The sources do not say which other systems rely on these intermediate CAs, so unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108015","severity":null,"published_at":"2026-10-27T17:16:57+00:00","modified_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}