Dashboard / CVE-2026-21766

CVE-2026-21766

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 36/100
Published: 2026-08-05 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: Required
S: Changed
C: High
I: None
A: None

Description

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.  This only affects applications using the default login portlet.

Weakness Classification (2)

References & Advisories (1)

Bug Bounty Relevance

36 / 100
✓ Network accessible

CVSS Score

5.4 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N

EPSS — Exploitation Probability

0.29%
Raw Score 0.002950
Percentile 22.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00295
2026-10-28
0.00295

Intelligence Sources

nvd ref →

External Links