What’s Vulnerable › Vulnerabilities

CVE-2026-21766: HCL Digital Experience and Digital Experience Compose insufficiently protects credentials

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-05 · updated 2026-10-23
• Weakness: CWE-522

Description

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.  This only affects applications using the default login portlet.

Affected products

• HCLSoftware HCL Digital Experience and Digital Experience Compose: 9.5

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659

Get alerted when CVE-2026-21766 or the next vulnerability affects your stack