CVE-2026-21766 - Vulnerability Details - OpenCVE

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00181.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products

References

Link	Providers
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659

History

Thu, 06 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 05 Aug 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.
Title		HCL Digital Experience and Digital Experience Compose insufficiently protects credentials
Weaknesses		CWE-522 CWE-532
References		https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: HCL

Published: 2026-08-05T20:11:19.443Z

Updated: 2026-08-06T13:12:46.283Z

Reserved: 2026-01-05T16:07:58.367Z

Link: CVE-2026-21766

Vulnrichment

Updated: 2026-08-06T13:12:43.055Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-05T21:45:04Z

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21766", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "state": "PUBLISHED", "assignerShortName": "HCL", "dateReserved": "2026-01-05T16:07:58.367Z", "datePublished": "2026-08-05T20:11:19.443Z", "dateUpdated": "2026-08-06T13:12:46.283Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-08-05T20:11:19.443Z"}, "title": "HCL Digital Experience and Digital Experience Compose insufficiently protects credentials", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-532", "description": "CWE-532 Insertion of sensitive information into log file", "type": "CWE"}]}], "affected": [{"vendor": "HCLSoftware", "product": "HCL Digital Experience and Digital Experience Compose", "versions": [{"status": "affected", "version": "9.5"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. \u00a0Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.\u00a0 This only affects applications using the default login portlet.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.  This only affects applications using the default login portlet.  "}]}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T13:12:38.947645Z", "id": "CVE-2026-21766", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T13:12:46.283Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "HCL Digital Experience and Digital Experience Compose insufficiently protects credentials", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HCLSoftware", "product": "HCL Digital Experience and Digital Experience Compose", "versions": [{"status": "affected", "version": "9.5"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. \u00a0Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.\u00a0 This only affects applications using the default login portlet.", "supportingMedia": [{"type": "text/html", "value": "The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.  This only affects applications using the default login portlet.  ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532 Insertion of sensitive information into log file"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-08-05T20:11:19.443Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T13:12:38.947645Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-08-06T13:12:43.055Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-21766", "state": "PUBLISHED", "dateUpdated": "2026-08-05T20:11:19.443Z", "dateReserved": "2026-01-05T16:07:58.367Z", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "datePublished": "2026-08-05T20:11:19.443Z", "assignerShortName": "HCL"}, "dataVersion": "5.2"}