CVE-2026-21837
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker can execute arbitrary operating system commands, inheriting the privileges of the vulnerable application, potentially leading to a complete system takeover and data compromise.
Risk Assessment
Risk includes complete system takeover, loss of data confidentiality and integrity, and potential privilege escalation within the environment.
Recommendation
Immediately update to a version that fixes this vulnerability and restrict access to the Digital Asset Management API to trusted users only.
Other vulnerabilities in HCL Digital Experience
See all- CVE-2026-21766Medium
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under very specific use cases and configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.
- CVE-2026-21826Medium
HCL Digital Experience and HCL Digital Experience Compose are susceptible to Host header injection. An attacker can manipulate the Host header, causing the application to behave unexpectedly.
Original NVD description (English source)
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.