CVE-2026-21837

8.7 highEPSS 0.9%

High (8.7) in hcltech. EPSS 0.9% chance of exploitation in the next 30 days.

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2026-06-05
Modified: 2026-07-23
Record from: the NVD, synced 2026-10-19

Affected

hcltech:digital_experience
hcltech:digital_experience_compose

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849

Check your stack JSON