Private keys for eight eMudhra intermediate CA certificates have been compromised, undermining certificate trust for outbound TLS connections in the HCL Notes Client. An attacker who can intercept network traffic can present forged server certificates and conduct a man‑in‑the‑middle attack, enabling interception or tampering with the content of outbound connections. This poses a serious confidentiality and integrity risk to any data transmitted from the client.

The vulnerability affects HCLSoftware’s Notes Client. No specific version numbers are listed in the available data, so all installations running the affected client are potentially impacted until a patch or update is applied.

The CVSS score of 9.1 indicates high severity. Although an EPSS score is not available, the vulnerability can be exploited by any unauthenticated network attacker who can insert themselves between the client and its communication targets. The lack of a KEV listing suggests the vulnerability is not yet part of a known exploit catalog, but the combination of a high CVSS score and the ability to conduct MITM attacks results in a high risk posture for affected deployments.