CVE-2026-21766
HCL Digital Experience and Digital Experience Compose insufficiently protects credentials
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.
| CWE | CWE-522 CWE-532 |
| Vendor | hclsoftware |
| Product | hcl digital experience and digital experience compose |
| Published | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for hclsoftware hcl digital experience and digital experience compose
Be the first to know when new medium vulnerabilities affecting hclsoftware hcl digital experience and digital experience compose are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
HCLSoftware / HCL Digital Experience and Digital Experience Compose
9.5