CVE-2026-9007

Awaiting Analysis Awaiting Analysis - Queue

Reflected Cross-Site Scripting in HCL Notes

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: TCS-CERT

Description

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Site Scripting (XSS). Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user. This issue affects HCL Notes: Release 12.0.2FP5HF8 on Linux 4.18.0-553.52.1.El8_10.X64_64#1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-9007

EUVD

EUVD-2026-44706

Affected Vendors & Products

Vendor	Product	Version / Range
hcl_software	hcl_notes	12.0.2fp5hf8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in HCL Notes. It occurs when user input is not properly neutralized during web page generation, allowing an attacker to inject malicious JavaScript code that executes in the context of another user's browser session.

Detection Guidance

Detecting this XSS vulnerability requires checking HCL Notes versions and monitoring web traffic for suspicious inputs. Inspect HTTP requests for unusual parameters or scripts in URLs. Use tools like Burp Suite or OWASP ZAP to scan for reflected XSS in HCL Notes interfaces.

Impact Analysis

An attacker could trick a user into clicking a malicious link, leading to execution of arbitrary JavaScript in the user's browser. This could result in session hijacking, theft of sensitive data, or unauthorized actions on behalf of the user.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements. For HIPAA, it may expose protected health information, risking compliance with security rules. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Apply the latest HCL Notes patches immediately. Disable or restrict access to vulnerable features if patches are unavailable. Implement input validation and output encoding in web interfaces. Monitor for unusual activity and update WAF rules to block XSS payloads.

Hi! I’m here to help you understand CVE-2026-9007. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70