CVE-2026-21788

Published: Mar 19, 2026Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: psirt@hcl.com (Secondary)

Description

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.

Affected (13)

Products: Hcltech: Connections

Hcltech

1 product

Connections

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Hcltech Connections	Version 8.0
Hcltech Connections	Version 8.0 cumulative_release10
Hcltech Connections	Version 8.0 cumulative_release11
Hcltech Connections	Version 8.0 cumulative_release12
Hcltech Connections	Version 8.0 cumulative_release1
Hcltech Connections	Version 8.0 cumulative_release2
Hcltech Connections	Version 8.0 cumulative_release3
Hcltech Connections	Version 8.0 cumulative_release4
Hcltech Connections	Version 8.0 cumulative_release5
Hcltech Connections	Version 8.0 cumulative_release6
Hcltech Connections	Version 8.0 cumulative_release7
Hcltech Connections	Version 8.0 cumulative_release8
Hcltech Connections	Version 8.0 cumulative_release9

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129107

Source: psirt@hcl.com

Vendor Advisory

Timeline

No history available yet.