Medium severity · published Aug 5, 2026
CVE-2026-21766
HCL Digital Experience and Digital Experience Compose insufficiently protects credentials
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HD
HCL Digital Experience and Digital Experience Compose · HCLSoftware
9.5 · source: vendor
Affected product
HD
HCL Digital Experience and Digital Experience Compose
HCLSoftware