PT-2026-46906 · Hclsoftware · Hcl Digital Experience

Published 2026-06-05 · Updated 2026-06-05 · CVE-2026-21837

NVD

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-21837

Affected Products

Hcl Digital Experience

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-21837 · Security Note
• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849 · Note