CVE-2026-67075
MediumCVSS 6.5Summary
HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain.
Risk Assessment
Attackers can inject malicious HTML content that could be used to deceive users and spoof a trusted domain. This may undermine trust in the site and lead to phishing.
Recommendation
Apply HCL Digital Experience 9.5 CF238 or later. It is also recommended to validate input and monitor for unusual content.
Other vulnerabilities in HCL Digital Experience
See all- CVE-2026-21766Medium
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under very specific use cases and configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.
- CVE-2026-21837High
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker can execute arbitrary operating system commands, inheriting the privileges of the vulnerable application, potentially leading to a complete system takeover and data compromise.
- CVE-2026-21826Medium
HCL Digital Experience and HCL Digital Experience Compose are susceptible to Host header injection. An attacker can manipulate the Host header, causing the application to behave unexpectedly.
Original NVD description (English source)
HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS