CVE-2026-21766

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.  This only affects applications using the default login portlet.

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-25)

CWEs

CWE-522, CWE-532

Published

2026-08-05

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659

Check your stackJSON