CVE-2026-21826
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
HCL Digital Experience and HCL Digital Experience Compose are susceptible to Host header injection. An attacker can manipulate the Host header, causing the application to behave unexpectedly.
Risk Assessment
Host header manipulation can lead to redirects, content injection, or other attacks, potentially compromising data integrity and confidentiality.
Recommendation
Update HCL Digital Experience and HCL Digital Experience Compose to the latest versions and implement Host header validation.
Other vulnerabilities in HCL Digital Experience
See all- CVE-2026-21766Medium
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under very specific use cases and configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.
- CVE-2026-21837High
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker can execute arbitrary operating system commands, inheriting the privileges of the vulnerable application, potentially leading to a complete system takeover and data compromise.
Original NVD description (English source)
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways.