What is the CVSS score of CVE-2026-21788?

CVE-2026-21788 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Connections are affected by CVE-2026-21788?

Organizations using HCL Connections should be aware of moderate risk from CVE-2026-21788, a cross-site scripting vulnerability rated CVSS 5.4.

How to fix or mitigate CVE-2026-21788?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Connections CVE-2026-21788

EUVD-2026-13075 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 HCL

XSS Connections

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 09:15 euvd

EUVD-2026-13075

Analysis Generated

Mar 19, 2026 - 09:15 vuln.today

CVE Published

Mar 19, 2026 - 08:44 nvd

MEDIUM 5.4

DescriptionCVE.org

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.

AnalysisAI

HCL Connections contains a reflected or stored cross-site scripting (XSS) vulnerability that allows authenticated attackers to inject malicious JavaScript into the application, which executes in the browsers of other users who interact with the crafted payload. An attacker with valid credentials can steal session cookies and authentication tokens, potentially compromising victim accounts and enabling further attacks such as lateral movement or data exfiltration. The vulnerability requires user interaction and authentication to exploit, resulting in a CVSS score of 5.4 (Medium severity), though the impact is cross-site scope.

Technical ContextAI

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting or XSS). The root cause is inadequate input validation or output encoding within HCL Connections' web interface, allowing user-supplied data to be rendered directly in HTML or JavaScript contexts without proper sanitization. The affected product is HCL Connections (identified via CPE cpe:2.3:a:hclsoftware:connections:*:*:*:*:*:*:*:*), a collaborative enterprise software platform that processes user input across multiple features such as activities, communities, profiles, and messaging. The vulnerability likely exists in template rendering or dynamic content generation functions where user-controlled parameters are not escaped or validated before being sent to the browser.

RemediationAI

Immediately consult the HCL security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129107 to identify the patched version for your HCL Connections deployment and upgrade to that version without delay. Until patching is feasible, implement compensating controls including enforcing HTTPS-only connections with HSTS headers, deploying a Content Security Policy (CSP) that prevents inline script execution and restricts script sources to trusted domains, enabling browser security features such as X-Frame-Options and X-Content-Type-Options headers, restricting network access to HCL Connections to trusted IP ranges, and conducting security awareness training to discourage users from clicking untrusted links within the application. Monitor for suspicious activity such as unusual authentication patterns or session hijacking attempts that may indicate exploitation attempts.