CVE-2026-67075
Received Received - Intake

HTML Injection in HCL Digital Experience

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: HCL Software

Description
HCL Digital Experience is affected by improper input sanitation.  This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-67075
EUVD
EUVD-2026-90498

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcl digital_experience From 9.5_cf238 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HCL Digital Experience has a flaw where user input is not properly sanitized, allowing HTML injection. This could let attackers spoof content from a trusted domain by injecting malicious HTML.

Detection Guidance

To detect this vulnerability, check the version of HCL Digital Experience running on your system. Compare it against HCL Digital Experience 9.5 CF238 or later. If your version is older, the system is likely vulnerable to HTML injection and content spoofing.

Impact Analysis

An attacker could trick users into believing fake but legitimate-looking content is from a trusted source, potentially leading to phishing or misinformation. User trust in the platform may be compromised.

Compliance Impact

This vulnerability could violate trust and integrity requirements in GDPR (data protection) and HIPAA (health data privacy) by enabling spoofing attacks that undermine user confidence in secure communications.

Mitigation Strategies

Apply HCL Digital Experience 9.5 CF238 or later to address the improper input sanitation and HTML injection vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67075. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart