HCL Hive CVE-2026-21754

User interaction is required - a victim must visit or interact with attacker-controlled content while authenticated to HCL Hive, satisfying the UI:R metric. No privileges are required on the attacker side (PR:N), but the attacker must be able to deliver malicious JavaScript into the victim's browser context, typically via XSS, phishing, or a malicious link. The cookie exposure (CWE-1004) is a server-side misconfiguration present in default or common Hive deployments; no special non-default configuration is required for the cookie flag to be missing. The broader lateral movement and container breakout conditions are not fully specified in available data - it is unknown whether those require additional misconfigurations, elevated permissions inside the platform, or specific deployment topologies. Exploitation is limited by the requirement for user interaction and by the need for an XSS delivery vector or equivalent JavaScript execution opportunity.

The CVSS base score of 5.4 Medium, with C:L and I:L, understates the potential blast radius described - lateral movement and container breakout are not Low-impact outcomes. This discrepancy suggests either the CVSS was scoped narrowly to the cookie flag issue alone, or the broader infrastructure weaknesses were assessed separately. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. The UI:R requirement reduces opportunistic exploitation risk, but a targeted phishing campaign or watering-hole scenario could realistically satisfy it. The PR:N metric confirms no authentication is needed on the attacker side, widening the potential attacker pool. Any organization running HCL Hive in an environment where users access it via browser - even a mid-sized municipal IT team in rybnik would find this relevant - should treat the lateral movement and container breakout claims seriously pending vendor clarification on scope, as those outcomes are disproportionate to a 5.4 score.

An attacker crafts a phishing email or malicious link targeting a Hive user, embedding content that triggers execution of JavaScript in the Hive application context. Because session cookies lack the HttpOnly flag, the injected script reads the victim's authentication token via document.cookie and exfiltrates it to an attacker-controlled server. The attacker then uses the stolen session to authenticate as the victim within Hive, potentially pivoting to internal services or exploiting the described container misconfiguration for deeper network access. No public proof-of-concept code has been identified.