Low severity · published Aug 31, 2026
CVE-2026-21827
HCL Connections is vulnerable to an information disclosure vulnerability
3.1
CVSS
0.2%
EPSS
No
On KEV
Description
HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Connections · HCLSoftware
7.0, 8.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21827
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21827
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130164
More from Connections
5.4
CVE-2026-67165
HCL Connections is vulnerable to cross-site scripting (XSS)
4.6
CVE-2026-21789
HCL Connections is vulnerable to broken access control
3.7
CVE-2025-62341
HCL Connections is vulnerable to server-side request forgery (SSRF)
3.5
CVE-2026-56538
HCL Connections is vulnerable to information disclosure
3.5
CVE-2026-56537
HCL Connections is vulnerable to information disclosure