HCL Hive CVE-2026-21752

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no special conditions beyond network reachability to an HCL Hive instance are required for exploitation. Exploitation impact is bounded to confidentiality (C:H, I:N, A:N), meaning an attacker gains unauthorized read access but cannot modify data or disrupt availability through this flaw alone. The primary limiting factor is network exposure: deployments accessible only on internal or firewalled segments face substantially lower realistic risk. The specific vulnerable third-party component enabling the authentication bypass is not named in available intelligence, preventing identification of configuration-level or feature-level prerequisites that might further constrain exploitability.

The CVSS 7.5 High score is supported by a fully unauthenticated, low-complexity, network-reachable vector (AV:N/AC:L/PR:N/UI:N), meaning any attacker who can reach an exposed HCL Hive endpoint satisfies exploitation prerequisites. No EPSS probability score was provided in the input, which is a notable gap - without it, quantitative exploitation likelihood cannot be assessed and the CVSS score alone should not drive deprioritization. The vulnerability does not appear in CISA KEV, so active in-the-wild exploitation is not confirmed; however, the description explicitly states the component flaws are 'publicly documented,' reducing the bar for independent rediscovery or weaponization. The scope is bounded to confidentiality (I:N, A:N), which lowers operational disruption risk but raises data exfiltration concern, particularly for enterprise deployments handling sensitive business data. Internet-exposed HCL Hive instances represent the highest-risk population; deployments isolated to internal or segmented networks face substantially lower realistic exploitability despite the identical CVSS score.

A remote, unauthenticated attacker with network access to an HCL Hive instance sends a crafted request that triggers an authentication bypass in one of the product's vulnerable bundled third-party components. Without supplying valid credentials, the attacker gains read access to protected application data or functionality. No public exploit code has been identified at time of analysis, but the component flaws are described as publicly documented, meaningfully lowering the effort required to develop working exploit code.