HCL DevOps Loop CVE-2026-21764

Exploitation requires an authenticated session with at least low-privilege access to HCL DevOps Loop (PR:L per CVSS vector). Attack complexity is high (AC:H), consistent with the description's qualifier 'under certain conditions' - meaning exploitation is not reliably reproducible against default inputs and likely depends on a specific application state, input combination, or configuration context that has not been publicly detailed. The network attack vector (AV:N) means the application must be reachable over a network, but no unauthenticated path is indicated. Impact is limited to confidentiality (C:L), with no integrity or availability effect. Factors limiting exploitation: required authenticated access, high attack complexity, and unspecified 'certain conditions' that must align for the flaw to manifest - placing this firmly outside automated or opportunistic attack scenarios.

The composite risk picture for this vulnerability is low. The NVD-assigned CVSS 3.1 base score of 3.1 is corroborated by the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - network-reachable but requiring authenticated access (PR:L) and high attack complexity (AC:H), with only limited confidentiality impact and no integrity or availability consequence. The AC:H metric is consistent with the description's qualifier 'under certain conditions,' implying non-trivial or environment-specific prerequisites that constrain reliable exploitation. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal; however, the combination of low CVSS, required authentication, high complexity, and absence from CISA KEV strongly suggests low real-world exploitation likelihood. No POC code is identified. SSVC signals: exploitation status is none, automatable is unlikely given AC:H, and technical impact is partial (C:L only). This is not a priority remediation item for most organizations, but teams operating HCL DevOps Loop should apply available patches as part of routine patch cycles given the vendor's PSIRT advisory issuance.

An authenticated user with low privileges sends a crafted request containing special characters to an HCL DevOps Loop input field that lacks proper validation. Under the specific conditions required by the AC:H vector - likely a particular application state, configuration, or input combination - the application processes the malformed input through downstream logic and surfaces limited sensitive information in its response. No public proof-of-concept code has been identified, and exploitation requires meeting non-trivial environmental conditions.