Low severity · published Oct 22, 2026
CVE-2026-21812
Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)
New
2.2
CVSS
0.1%
EPSS
No
On KEV
Description
HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
AppScan Integration with Azure Boards for ASoC & A360 · HCL Software
Version 1.0.0 · source: vendor
Affected product
AI
AppScan Integration with Azure Boards for ASoC & A360
HCL Software
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21812
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21812
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134539
More from AppScan Integration with Azure Boards for ASoC & A360
3.8
CVE-2026-21811
Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)