Medium severity · published Aug 24, 2026
CVE-2026-21759
HCL Hive is affected by an information exposure vulnerability
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HH
HCL Hive · HCLSoftware
1.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21759
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131731
More from HCL Hive
7.5
CVE-2025-68825
HCL Hive is affected by incorrect default permissions
7.5
CVE-2026-21752
HCL Hive is affected by a use of vulnerable third-party components
7.4
CVE-2026-21751
HCL Hive is affected by use of a cryptographic primitive with a risky implementation
7.2
CVE-2026-21756
HCL Hive is affected by a broken access control vulnerability
5.3
CVE-2026-21755
HCL Hive is affected by a missing rate limit