CVE-2026-21837
Status: AnalyzedHigh (8.7)—
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.
CVSS
- Version: 4.0
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Base score: 8.7
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.92%
- Percentile among all scored CVEs: 59
- Score date: 9/30/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-78
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-21837",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-21837",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2026-06-09T13:22:58.176587Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "psirt@hcl.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 8.7,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "psirt@hcl.com",
"affectedData": [
{
"vendor": "HCLSoftware",
"product": "Digital Experience",
"versions": [
{
"status": "affected",
"version": "9.5"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-06-05T07:16:30.027",
"references": [
{
"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849",
"tags": [
"Vendor Advisory"
],
"source": "psirt@hcl.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@hcl.com",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise."
},
{
"lang": "es",
"value": "HCL Digital Experience está afectado por una vulnerabilidad de inyección de comandos del sistema operativo en la API de Gestión de Activos Digitales. Un atacante puede ejecutar comandos arbitrarios del sistema operativo, normalmente heredando los privilegios de la aplicación vulnerable, lo que podría posiblemente llevar a una toma de control completa del sistema y compromiso de datos."
}
],
"lastModified": "2026-07-23T07:10:00.113",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7726847-A415-4C5B-9997-67DDA48381D7"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79E93476-E767-4F67-88B2-790555132DD6"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf171:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E86C441-38FC-46D2-BC76-E241C6F25682"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf172:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "95B210EB-3C1F-48E2-97A3-BC33BCA5613E"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf173:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37E8CE4C-60AF-4501-B2A8-887D894A83E1"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "077ACEC7-4FB3-4546-B25C-27FF87E744E7"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf181:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5987539C-F1E2-4DA4-A94D-56B49E1A89C6"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf182:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4769476-6D01-407E-8DD5-15AE47F15A19"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf183:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "209F0AD7-CB0F-4888-83C4-935167CD8A9E"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf184:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5B4E0077-3EE3-4F45-9D0D-9F2F7F06A21A"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf19:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A643F55-D3C0-4681-832F-64D091EECA0E"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf191:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5E3A637-FBCE-4EA7-8BE7-662F19219C1C"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf192:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DCA57208-8F6D-4110-8A95-0D8AC9DE25F1"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf193:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02E5D3F6-DB54-4193-9884-81654CF85293"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf194:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B39D31A9-04D2-4E2D-A1F9-F67610CEF425"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf195:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2474A59-CF18-49CC-8B26-C40B31D521DB"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf196:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DDDACE6E-8A8F-4F37-A159-288E4CA3FA23"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf197:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4956E2A0-7519-4CF1-AA23-25F1E75C4704"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf198:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "053D3981-2629-41B1-937E-76C44C94F412"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf199:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FE0278A5-9F19-40E5-A2D9-AFFB9D621AEA"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf200:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89668531-4116-4B30-B921-89CE1AFAB5AB"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf201:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0E9720DF-C28B-4E52-B1F1-6CB15DB7570B"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf202:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CE04EFCC-AADF-444F-97F6-8C7EA38E9810"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf203:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9C8052E-06F3-4D71-86D2-CAC7DD641406"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf204:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B4C6DE0-FA68-4F34-8D8D-E8A2EF0BF986"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf205:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "698363E8-98C1-4945-926D-439909962E86"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf206:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D39092E3-98FC-4335-9D90-C8C34A6B20B3"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf207:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B34E56EF-CACF-4B94-A6D8-FD59F9B903F9"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf208:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F877C3F-7DEA-48C0-A1BD-59CE32F25CE1"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf209:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13338A64-8125-4CF0-9E20-13447AF40C06"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf210:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6EA6F232-73A9-4AD5-A4B3-57E5A87F21AA"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf211:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7FFF566-E918-40B4-8489-1A493D644485"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf212:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "154CBFD6-E92F-4014-8BC9-5E0276DFEFAA"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf213:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6EA08207-8052-459B-87E5-FD85975150F9"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf214:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7E3274E-0A91-486A-9BE1-D08053940E08"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf215:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "18C33615-3520-4F57-9592-783FBFF09B01"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf216:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76D963EF-2E05-4492-8C57-D9D80F8ECBCA"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf217:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5D3AA63E-1687-43DB-B4BE-17C747057494"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf218:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B5E6EAC-B190-4338-A851-B734EB885C13"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf219:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DB5EF9A-55BF-4D33-96B6-D12414C73706"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf220:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E8F24E20-3513-4DB4-BB03-D80D6B9EE6B0"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf221:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E1B2E02E-BAEA-4F94-ACB5-4BC03DEB642E"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf222:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F63C4AF-7730-4430-96E2-15DC2D89E5B9"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf223:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E06BD8F5-4BDD-4F47-BD22-91DFAD20D03A"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf224:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B3FEBF7-FA66-4A86-A76B-023F99B7E2E1"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf225:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1683A002-768A-49F8-9724-00F755DB7913"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf226:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFA28CF4-F7A5-40F7-96EC-12112EA5E8FE"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf227:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB3030B5-491F-4EFD-8F83-B17AF4915860"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf228:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8FA43DC4-DE70-4B25-BE19-02E5911849A9"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf229:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "064C3181-01AA-4128-845B-278364199887"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf230:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A2DA489-C5B8-4C6A-931F-4B2C6022733C"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf231:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CEB2C47-4CE4-46B7-A332-E20B1F079140"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf232:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F149D74-1AFB-415D-892D-BA10DAE6221E"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf233:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3DED888-8B7B-4AFF-8577-B0F57F30035C"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience:9.5:cf234:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E4A7EF6-1954-426A-A8B1-F0D57E2CCCBA"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA10D3C3-C284-4880-AC26-BBB7DB38A23B"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf224:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1B6A0A6-CBC8-42B3-9718-4B9F668CB9A4"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf225:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2700CD74-E4D8-4FE6-89B2-55043A11F71E"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf226:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AFB9AFA0-C510-4AFA-800B-FC356E2CD60E"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf227:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED000717-515A-404F-8CD7-015391857A74"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf228:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EDE748ED-402C-40CF-9913-CA3398B39DD3"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf229:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BF2E7C7C-47CE-4216-8019-D3EDA5835104"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf230:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "45417D1B-D339-409C-8E28-E939F118BCD8"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf231:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B7631B4-7C09-4FB7-A3DD-81A681BBACC0"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf232:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9442342-3542-49C8-B01E-D69E4D3FFAD0"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf233:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7F0272C6-012C-4DB2-BAF5-461B3D4EE588"
},
{
"criteria": "cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf234:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A9E3C55-054D-48C7-BCEC-8E1540317C7F"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@hcl.com"
}