HCLSoftware HCL DevOps Deploy vulnerabilities

Latest HCLSoftware HCL DevOps Deploy CVEs

Newest publication first

1. CVE-2026-56458 HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains

   Published 2026-07-09

   High·CVSS 7.5 EPSS 0.26%

   HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.