What’s Vulnerable › Vulnerabilities

CVE-2021-27760: HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-06 · updated 2026-06-17
• Weakness: CWE-20

Description

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.

Affected products

• HCL Software HCL iNotes: 11.0.0, 11.0.1, 11.0.1-fixpack1, 11.0.1-fixpack2, 11.0.1-fixpack3, 11.0.1-fixpack4

References

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097670
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097670

Get alerted when CVE-2021-27760 or the next vulnerability affects your stack