HCL Hive CVE-2026-21758

The CVSS vector (AV:N/AC:H/PR:N/UI:N) specifies that exploitation is network-accessible and requires no authentication or user interaction, but demands high attack complexity - meaning specific conditions such as a particular application state, timing constraint, or protocol configuration must be met that are non-trivial to reproduce reliably. The description references 'host environment' as the information source, suggesting leaked data may include system-level details such as paths, hostnames, or version strings. No specific feature toggle, non-default configuration, or platform restriction is named in available data as a hard prerequisite. Exploitation is concretely limited by the AC:H requirement, which significantly narrows the realistic attacker pool to those who can reliably engineer the required preconditions. No user interaction is required once the complexity condition is satisfied.

The CVSS score of 3.7 (Low) is internally consistent: the high attack complexity (AC:H) substantially suppresses real-world exploitability compared to a straightforward unauthenticated flaw, and the impact is limited to low confidentiality disclosure with no integrity or availability consequences. No EPSS probability was supplied in available data, preventing quantitative exploitation likelihood assessment. There is no CISA KEV listing and no known public proof-of-concept, leaving exploitation status as unconfirmed. The primary real-world concern is reconnaissance value - successfully exploiting this gives an attacker host environment details that can inform follow-on attacks, not direct system compromise. The high AC:H barrier means only sophisticated or patient attackers are likely to succeed, making this a low-priority remediation item for most organizations. No conflicting signals exist between CVSS and the description, though the absence of EPSS data and a precise fix version leaves the overall picture partially incomplete.

A remote attacker without credentials sends specially crafted network requests to an internet- or intranet-accessible HCL Hive instance, timing or structuring them to satisfy the high attack complexity requirement. The application responds with or inadvertently leaks sensitive host environment details - such as internal paths, software versions, or configuration values - which the attacker records to refine subsequent targeted attacks against the host. No public exploit code is known at time of analysis, making opportunistic mass exploitation unlikely.