Connections CVE-2026-21788

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates moderate real-world risk: the vulnerability is remotely exploitable over the network with low attack complexity and requires only low-level user privileges (authenticated access), but crucially depends on user interaction (a victim clicking a link or viewing a malicious page). The cross-site scope (S:C) increases impact by affecting resources beyond the vulnerable component. While confidentiality and integrity are partially compromised (L ratings), availability is not affected. The lack of administrative privileges required and the network accessibility make this a practical threat in enterprise environments where HCL Connections is widely deployed. However, the medium CVSS score and requirement for user interaction place this below critical severity. Without publicly disclosed exploit code or active exploitation in the wild (KEV status unknown from provided data), this represents a standard XSS vulnerability requiring patching but not an emergency zero-day. Organizations with strong security awareness training and content security policies (CSP) have additional defensive layers.

An attacker with valid HCL Connections credentials crafts a malicious community post, activity comment, or profile message containing injected JavaScript (for example, a hidden iframe loading a phishing page or a script that captures and exfiltrates the user's session cookie). When a legitimate user views the attacker's content, the browser executes the injected script in the context of the HCL Connections domain, allowing the attacker to steal the victim's authentication cookie and impersonate them in subsequent requests. The attacker can then access sensitive documents, impersonate the victim in communications, or modify content on behalf of the compromised user without requiring the victim to click an external link if the XSS is stored; if it is reflected, the attacker would need to trick the victim into clicking a crafted URL.