HCLSoftware Notes Client: Trust bypass via compromised eMudhra intermediate CA keys
Summary
Private keys of eight eMudhra intermediate CA certificates have been compromised, which affects certificate trust for outbound network requests in HCL Notes Client. An unauthenticated network attacker who holds these keys could spoof server certificates and perform a man-in-the-middle attack to intercept or modify outbound TLS connections. The vulnerability is rated CRITICAL (CVSS v4.0 9.1) by the CNA, but NVD analysis is still pending.
Affected
- HCLSoftware Notes Client 2.0.2 FP8 and earlier (exact range garbled in CNA record, confirm with HCL)
- HCLSoftware Notes Client 14.0 FP5 and earlier
- HCLSoftware Notes Client 14.5
- HCLSoftware Notes Client 14.5.1 FP1 and earlier
- Default configuration is listed as unaffected.
Fixed in
Unknown.
Workaround
Unknown. No HCL workaround has been identified. Ask HCL whether Notes Client uses the OS trust store or its own bundled trust list, as this determines whether OS updates remove the trust.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- The key recovery is publicly demonstrated, according to research sources.
- eMudhra states that only one intermediate was deployed in production and none issued end-entity certificates (vendor claim, not independently verified).
Our recommendation
- Check whether HCL Notes Client is deployed and whether it is an affected version.
- Contact HCL for the fixed build and the exact affected versions, and read KB0134749.
- Check whether the OS or CA bundle updates have removed the affected eMudhra intermediate CAs and apply them.
- Rebuild container images that bundle CA certificates.
- Review HCL PSIRT information on related eMudhra Java issues (CVE-2026-91403, CVE-2026-114820).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HCL Knowledge Base KB0134749 support.hcl-software.com
- Tenable CVE record www.tenable.com
- eMudhra certificate security incident emudhra.com
- HCL PSIRT community blog support.hcl-software.com
- Google Chrome blog on compromised eMudhra intermediate CAs blog.google
- Aikido analysis of eMudhra CA compromise www.aikido.dev
- The Hacker News report on eMudhra CA keys thehackernews.com
- ENISA EUVD entry euvd.enisa.europa.eu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:21.
Original description (NVD)
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.