CVE-2026-21826
Host Header Injection in HCL Digital Experience
Publication date: 2026-06-05
Last updated on: 2026-06-05
Assigner: HCL Software
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hcl | digital_experience | * |
| hcl | digital_experience_compose | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves Host header injection in HCL Digital Experience and HCL Digital Experience Compose. An attacker can manipulate the Host header in HTTP requests, which may cause the application to behave in unexpected or unintended ways.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to unexpected application behavior, potentially allowing attackers to perform actions such as web cache poisoning, password reset poisoning, or redirecting users to malicious sites. The CVSS score indicates a moderate impact with low complexity and no privileges required, but user interaction is needed.