---
id: "CVE-2026-108015"
kind: "vulnerability"
aliases: ["CVE-2026-108015"]
title: "eMudhra intermediate CA private keys compromised, enabling TLS spoofing in HCL Notes"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise-clients", "hcl-notes", "vendor", "windows"]
not_affected_if: []
published_at: "2026-10-27T17:16:57+00:00"
first_seen_at: "2026-10-27T17:32:45+00:00"
updated_at: "2026-10-27T17:34:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108015", "first_seen_at": "2026-10-27T17:32:45+00:00"}]
---

# eMudhra intermediate CA private keys compromised, enabling TLS spoofing in HCL Notes

Private keys for eight eMudhra intermediate CA certificates have been compromised, so the certificates can no longer be trusted. An unauthenticated network attacker could use them to spoof server certificates and run a man-in-the-middle attack on outbound TLS connections from HCL Notes Client.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether HCL Notes Client is installed and which version runs, since the sources name no fixed version.
- Check whether the trust store includes any of the eight eMudhra intermediate CA certificates; the sources do not list their identifiers, so unknown.

## Fix

- Follow the vendor guidance at https://emudhra.we-have-a-problem.com/ and the HCL product advisory; the sources do not give a patched version or steps, so unknown.

## Timeline

- 2026-10-27T17:32:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108015

## From the sources

Private keys for eight eMudhra intermediate CA certificates have been  compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client.  An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_