Low severity · published Oct 22, 2026
CVE-2026-21811
Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
New
3.8
CVSS
0.2%
EPSS
No
On KEV
Description
HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Affected product
AI
AppScan Integration with Azure Boards for ASoC & A360
HCL Software
More from AppScan Integration with Azure Boards for ASoC & A360
2.2
CVE-2026-21812
Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)