Read the docs
TI-2023-12595 Aliases CVE-2023-28008GHSA-pp98-436h-9qgg

HCL Workload Automation is vulnerable to XML External Entity (XXE) Injection

Priority LOW 37CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

HCL Workload Automation 9.4, 9.5, and 10.1 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00821 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HCL SoftwareWorkload Automation<=9.5.0.6, 10.1.0.0—No fix listedCNA
  • Workload Automation VendorHCL Software Affected <=9.5.0.6, 10.1.0.0 Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:workload_automation:9.4.0:-:*:*:*:*:*:*9.4.0VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_3:*:*:*:*:*:*9.4.0 fix_pack_3VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_4:*:*:*:*:*:*9.4.0 fix_pack_4VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_5:*:*:*:*:*:*9.4.0 fix_pack_5VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_6:*:*:*:*:*:*9.4.0 fix_pack_6VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_7:*:*:*:*:*:*9.4.0 fix_pack_7VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.5.0:-:*:*:*:*:*:*9.5.0VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_1:*:*:*:*:*:*9.5.0 fix_pack_1VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_2:*:*:*:*:*:*9.5.0 fix_pack_2VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_3:*:*:*:*:*:*9.5.0 fix_pack_3VulnerableHCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.4.0:-:*:*:*:*:*:* Versions 9.4.0 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_3:*:*:*:*:*:* Versions 9.4.0 fix_pack_3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_4:*:*:*:*:*:* Versions 9.4.0 fix_pack_4 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_5:*:*:*:*:*:* Versions 9.4.0 fix_pack_5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_6:*:*:*:*:*:* Versions 9.4.0 fix_pack_6 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.4.0:fix_pack_7:*:*:*:*:*:* Versions 9.4.0 fix_pack_7 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.5.0:-:*:*:*:*:*:* Versions 9.5.0 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_1:*:*:*:*:*:* Versions 9.5.0 fix_pack_1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_2:*:*:*:*:*:* Versions 9.5.0 fix_pack_2 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_3:*:*:*:*:*:* Versions 9.5.0 fix_pack_3 Vulnerable ·HCL Software
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_4:*:*:*:*:*:*9.5.0 fix_pack_4VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_5:*:*:*:*:*:*9.5.0 fix_pack_5VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_6:*:*:*:*:*:*9.5.0 fix_pack_6VulnerableHCL Software
cpe:2.3:a:hcltech:workload_automation:10.1.0:-:*:*:*:*:*:*10.1.0VulnerableHCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_4:*:*:*:*:*:* Versions 9.5.0 fix_pack_4 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_5:*:*:*:*:*:* Versions 9.5.0 fix_pack_5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:9.5.0:fix_pack_6:*:*:*:*:*:* Versions 9.5.0 fix_pack_6 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:workload_automation:10.1.0:-:*:*:*:*:*:* Versions 10.1.0 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-28008
  2. 2026-10-03 Alias added: GHSA-pp98-436h-9qgg

References

Advisory 1

  • TI-2023-12596 HCL Workload Automation is vulnerable to XML External Entity (XXE) Injection CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences