CVE-2026-21766CWE-522CWE-532

CVE-2026-21766

Medium · published August 6, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.  This only affects applications using the default login portlet.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00295 · 21.0th percentile
Weaknesses
CWE-522 · Insufficiently Protected Credentials; CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-08-06T00:17Z
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132659 · [email protected]
EPSS history
Timeline
  • 05 AUG 20:11Z
    HCL Digital Experience and Digital Experience Compose insufficiently protects credentials
    cvelistv5