CVE-2026-21837

{"id": "CVE-2026-21837", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21837", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-09T13:22:58.176587Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "Digital Experience", "versions": [{"status": "affected", "version": "9.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-05T07:16:30.027", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.\u00a0 An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise."}, {"lang": "es", "value": "HCL Digital Experience est\u00e1 afectado por una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo en la API de Gesti\u00f3n de Activos Digitales. Un atacante puede ejecutar comandos arbitrarios del sistema operativo, normalmente heredando los privilegios de la aplicaci\u00f3n vulnerable, lo que podr\u00eda posiblemente llevar a una toma de control completa del sistema y compromiso de datos."}], "lastModified": "2026-07-23T07:10:00.113", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7726847-A415-4C5B-9997-67DDA48381D7"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf17:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79E93476-E767-4F67-88B2-790555132DD6"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf171:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E86C441-38FC-46D2-BC76-E241C6F25682"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf172:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95B210EB-3C1F-48E2-97A3-BC33BCA5613E"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf173:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37E8CE4C-60AF-4501-B2A8-887D894A83E1"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf18:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "077ACEC7-4FB3-4546-B25C-27FF87E744E7"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf181:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5987539C-F1E2-4DA4-A94D-56B49E1A89C6"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf182:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4769476-6D01-407E-8DD5-15AE47F15A19"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf183:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "209F0AD7-CB0F-4888-83C4-935167CD8A9E"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf184:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B4E0077-3EE3-4F45-9D0D-9F2F7F06A21A"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A643F55-D3C0-4681-832F-64D091EECA0E"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf191:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5E3A637-FBCE-4EA7-8BE7-662F19219C1C"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf192:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCA57208-8F6D-4110-8A95-0D8AC9DE25F1"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf193:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02E5D3F6-DB54-4193-9884-81654CF85293"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf194:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B39D31A9-04D2-4E2D-A1F9-F67610CEF425"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf195:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2474A59-CF18-49CC-8B26-C40B31D521DB"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf196:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDDACE6E-8A8F-4F37-A159-288E4CA3FA23"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf197:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4956E2A0-7519-4CF1-AA23-25F1E75C4704"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf198:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "053D3981-2629-41B1-937E-76C44C94F412"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf199:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE0278A5-9F19-40E5-A2D9-AFFB9D621AEA"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf200:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89668531-4116-4B30-B921-89CE1AFAB5AB"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf201:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E9720DF-C28B-4E52-B1F1-6CB15DB7570B"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf202:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE04EFCC-AADF-444F-97F6-8C7EA38E9810"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf203:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9C8052E-06F3-4D71-86D2-CAC7DD641406"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf204:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B4C6DE0-FA68-4F34-8D8D-E8A2EF0BF986"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf205:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "698363E8-98C1-4945-926D-439909962E86"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf206:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D39092E3-98FC-4335-9D90-C8C34A6B20B3"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf207:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B34E56EF-CACF-4B94-A6D8-FD59F9B903F9"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf208:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F877C3F-7DEA-48C0-A1BD-59CE32F25CE1"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf209:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13338A64-8125-4CF0-9E20-13447AF40C06"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf210:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EA6F232-73A9-4AD5-A4B3-57E5A87F21AA"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf211:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7FFF566-E918-40B4-8489-1A493D644485"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf212:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "154CBFD6-E92F-4014-8BC9-5E0276DFEFAA"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf213:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EA08207-8052-459B-87E5-FD85975150F9"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf214:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7E3274E-0A91-486A-9BE1-D08053940E08"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf215:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18C33615-3520-4F57-9592-783FBFF09B01"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf216:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76D963EF-2E05-4492-8C57-D9D80F8ECBCA"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf217:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D3AA63E-1687-43DB-B4BE-17C747057494"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf218:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B5E6EAC-B190-4338-A851-B734EB885C13"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf219:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DB5EF9A-55BF-4D33-96B6-D12414C73706"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf220:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8F24E20-3513-4DB4-BB03-D80D6B9EE6B0"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf221:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1B2E02E-BAEA-4F94-ACB5-4BC03DEB642E"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf222:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F63C4AF-7730-4430-96E2-15DC2D89E5B9"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf223:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E06BD8F5-4BDD-4F47-BD22-91DFAD20D03A"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf224:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B3FEBF7-FA66-4A86-A76B-023F99B7E2E1"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf225:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1683A002-768A-49F8-9724-00F755DB7913"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf226:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFA28CF4-F7A5-40F7-96EC-12112EA5E8FE"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf227:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB3030B5-491F-4EFD-8F83-B17AF4915860"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf228:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FA43DC4-DE70-4B25-BE19-02E5911849A9"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf229:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "064C3181-01AA-4128-845B-278364199887"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf230:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A2DA489-C5B8-4C6A-931F-4B2C6022733C"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf231:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CEB2C47-4CE4-46B7-A332-E20B1F079140"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf232:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F149D74-1AFB-415D-892D-BA10DAE6221E"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf233:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3DED888-8B7B-4AFF-8577-B0F57F30035C"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf234:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E4A7EF6-1954-426A-A8B1-F0D57E2CCCBA"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EA10D3C3-C284-4880-AC26-BBB7DB38A23B"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf224:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1B6A0A6-CBC8-42B3-9718-4B9F668CB9A4"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf225:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2700CD74-E4D8-4FE6-89B2-55043A11F71E"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf226:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFB9AFA0-C510-4AFA-800B-FC356E2CD60E"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf227:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED000717-515A-404F-8CD7-015391857A74"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf228:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDE748ED-402C-40CF-9913-CA3398B39DD3"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf229:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF2E7C7C-47CE-4216-8019-D3EDA5835104"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf230:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45417D1B-D339-409C-8E28-E939F118BCD8"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf231:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B7631B4-7C09-4FB7-A3DD-81A681BBACC0"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf232:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9442342-3542-49C8-B01E-D69E4D3FFAD0"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf233:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F0272C6-012C-4DB2-BAF5-461B3D4EE588"}, {"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf234:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A9E3C55-054D-48C7-BCEC-8E1540317C7F"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}