CVE-2026-67165
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
HCL Connections is vulnerable to a cross-site scripting (XSS) attack that allows an attacker to execute arbitrary script code in the browser of an unsuspecting user. This may lead to stealing cookie-based authentication credentials and compromising user accounts.
Risk Assessment
The attack can lead to theft of authentication credentials and account takeover, potentially resulting in unauthorized access to data and further attacks.
Recommendation
Apply vendor-provided patches for HCL Connections as soon as possible and educate users on recognizing suspicious links.
Other vulnerabilities in HCL Connections
See all- CVE-2026-21827Low
HCL Connections is vulnerable to information disclosure, which could allow a user to obtain data they are not entitled to, caused by improper handling of request data.
- CVE-2025-62341Low
HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised, possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.
- CVE-2026-56538Low
An information disclosure vulnerability in HCL Connections via a specific endpoint. In certain scenarios, this could lead to sensitive information being disclosed to unauthorized users.
- CVE-2026-56537Low
An information disclosure vulnerability in HCL Connections due to improper handling of request data. A user can obtain sensitive information they are not entitled to.
- CVE-2025-15619Low
A broken access control vulnerability in HCL Connections may allow an unauthorized user to view data in a single specific scenario.
Original NVD description (English source)
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS