HCL Domino Server: Man-in-the-middle risk from compromised eMudhra CA keys
Summary
HCL Domino Server trusts certificate chains that include eight intermediate CA certificates from eMudhra whose private keys were compromised. An unauthenticated network attacker positioned on the traffic path could use these keys to spoof server certificates and intercept or modify outbound TLS connections made by Domino. The issue affects outbound network request features; Domino is not exposed as an inbound listener through this flaw.
Affected
- HCLSoftware Domino Server: versions up to and including 2.0.2 FP8, up to and including 14.0 FP5, 14.5, and up to and including 14.5.1 FP1 (version boundaries from third-party mirrors, not yet verified against the vendor advisory)
- Default configuration: unaffected according to the CNA record
Fixed in
Unknown. Check HCL advisory KB0134742 for the fixed builds.
Workaround
- The eMudhra intermediate CAs have been revoked by eMudhra.
- Browser and OS vendors (Google Chrome CRLSet, Microsoft Edge trust list) have blocked the affected intermediate CAs; this does not fully resolve application-level exposure in Domino.
- Restrict outbound TLS connections from the Domino server where possible.
Exploitation
- No known exploitation in the wild.
- CISA KEV: not listed.
- No public proof of concept for the Domino issue itself.
- EPSS: 0.13 % (percentile 2).
Our recommendation
- Check HCL advisory KB0134742 and apply the fixed Domino build as soon as it is available.
- Identify whether Domino outbound connections rely on trust chains that include eMudhra CAs.
- Restrict outbound TLS from the Domino server and avoid untrusted networks for it.
- Monitor for certificate warnings or unexpected certificate changes on outbound connections.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HCL Security Bulletin KB0134742 support.hcl-software.com
- eMudhra certificate security incident emudhra.com
- Google Chrome protection against compromised eMudhra CAs blog.google
- Microsoft Edge block of eMudhra certificates cybersecuritynews.com
- Help Net Security: eMudhra private keys compromised www.helpnetsecurity.com
- VulDB entry CVE-2026-108014 vuldb.com
- Strix CVE-2026-108014 www.strix.ai
- PSIRT CVE-2026-108014 psirt.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:20.
Original description (NVD)
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.