Low severity · published Aug 26, 2026
CVE-2025-62341
HCL Connections is vulnerable to server-side request forgery (SSRF)
3.7
CVSS
0.2%
EPSS
No
On KEV
Description
HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Connections · HCLSoftware
7.0, 8.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62341
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62341
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128493
More from Connections
5.4
CVE-2026-67165
HCL Connections is vulnerable to cross-site scripting (XSS)
5.4
CVE-2026-21788
HCL Connections is vulnerable to cross-site scripting (XSS)
4.6
CVE-2026-21789
HCL Connections is vulnerable to broken access control
3.5
CVE-2026-56538
HCL Connections is vulnerable to information disclosure
3.5
CVE-2026-56537
HCL Connections is vulnerable to information disclosure