CVE-2026-9007CWE-79

Reflected XSS in HCL Notes

Medium · published July 15, 2026

CVSS v4.0
5.5
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected

Cross-Site Scripting (XSS).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user.

This issue affects HCL Notes: Release 12.0.2FP5HF8 on Linux 4.18.0-553.52.1.El8_10.X64_64#1.

The record
Technical detail
CVSS v4.0
5.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.00436 · 36.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-15T15:41Z
EPSS history
Timeline
  • 15 JUL 15:41Z
    Reflected XSS in HCL Notes
    cvelistv5