CVE-2026-21766
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under very specific use cases and configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.
Risk Assessment
User credentials may leak into logs, potentially leading to unauthorized system access.
Recommendation
Apply available patches or adjust configuration to avoid logging sensitive information.
Other vulnerabilities in HCL Digital Experience
See all- CVE-2026-21837High
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker can execute arbitrary operating system commands, inheriting the privileges of the vulnerable application, potentially leading to a complete system takeover and data compromise.
- CVE-2026-21826Medium
HCL Digital Experience and HCL Digital Experience Compose are susceptible to Host header injection. An attacker can manipulate the Host header, causing the application to behave unexpectedly.
Original NVD description (English source)
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.