HCLSoftware Vulnerabilities and Affected Products
Vulnerabilities associated with Connections.
Products
Clear product- Aftermarket EPC14 vulnerabilities
- MyCloud7 vulnerabilities
- Connections6 vulnerabilities
- DevOps Loop4 vulnerabilities
- IntelliOps Event Management4 vulnerabilities
- BigFix IVR3 vulnerabilities
- HCL DevOps Deploy / HCL Launch3 vulnerabilities
- Traveler for Microsoft Outlook3 vulnerabilities
- BigFix Platform2 vulnerabilities
- BigFix Service Management (SM)2 vulnerabilities
- BigFix WebUI2 vulnerabilities
- DevOps Plan2 vulnerabilities
- DFXServer2 vulnerabilities
- Digital Experience2 vulnerabilities
- HCL BigFix Mobile2 vulnerabilities
- Traveler2 vulnerabilities
- BigFix Cloud Lifecycle Management1 vulnerability
- BigFix Compliance1 vulnerability
- BigFix Remote Control Server1 vulnerability
- BigFix SCM Reporting1 vulnerability
- Commerce1 vulnerability
- DevOps Deploy1 vulnerability
- DFMPro for CATIA1 vulnerability
- DFXAnalytics1 vulnerability
- Digital Experience & DX Compose1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
HCL Connections is vulnerable to information disclosureAn endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users. CWE-213Jul 27, 2026 | CVSS3.5v3.1 | EPSS0.156% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
HCL Connections is vulnerable to information disclosureHCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.they are not entitled to, caused by improper handling of request data. CWE-209Jul 27, 2026 | CVSS3.5v3.1 | EPSS0.156% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
HCL Connections is vulnerable to broken access controlHCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario. | CVSS3.5v3.1 | EPSS0.098% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-21789MEDIUM | HCL Connections is vulnerable to broken access controlHCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios. CWE-863May 18, 2026 | CVSS4.6v3.1 | EPSS0.122% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-21788MEDIUM | HCL Connections is vulnerable to cross-site scripting (XSS)HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks. CWE-79Mar 19, 2026 | CVSS5.4v3.1 | EPSS0.164% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
HCL Connections is vulnerable to information disclosureHCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser. CWE-213Feb 20, 2026 | CVSS3.5v3.1 | EPSS0.255% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |