HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API
CVE-2026-21837

8.7HIGH

Key Information:

Vendor

HCL Softwaresoftware

Status
Digital Experience
Vendor
CVE Published:
5 June 2026

What is CVE-2026-21837?

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.

Affected Version(s)

Digital Experience 9.5

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.