What is the CVSS score of CVE-2026-21824?

CVE-2026-21824 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Commerce are affected by CVE-2026-21824?

HCL Commerce versions 7 through 9.1.19 contain a privilege escalation vulnerability (CVSS 8.8) that allows any low-level authenticated user to gain administrative access, access other users' personal…

How to fix or mitigate CVE-2026-21824?

Within 24 hours, identify all HCL Commerce 7.x-9.1.19 deployments and whether they are internet-accessible or used by untrusted internal users; if internet-facing, consider temporary restriction of administrative functions or access. Within 7 days, contact HCL support to request interim mitigations or guidance, implement strict network segmentation isolating Commerce systems, and review access logs for signs of unauthorized privilege escalation. Within 30 days, develop and execute an upgrade plan to HCL Commerce 9.1.20 or later once patches are released, and conduct a security assessment of affected systems to validate no unauthorized administrative activity occurred.

Commerce CVE-2026-21824

EUVD-2026-45974 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-07-20 HCL

GHSA-rvf7-vq7f-5gc3

Privilege Escalation Denial Of Service Commerce Hclsoftware

8.8

CVSS 3.1 · Vendor: HCL

Severity by source

Vendor (HCL) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (HCL) · only source for this CVE.

CVSS VectorVendor: HCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 17:51 vuln.today

CVE Published

Jul 20, 2026 - 15:04 cve.org

HIGH 8.8

DescriptionCVE.org

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.

AnalysisAI

Privilege escalation in HCL Commerce (versions 7 through 9.1.19) allows an authenticated low-privileged user to elevate their rights and perform unauthorized administrative operations, disclose other users' personal data, and cause denial of service. The flaw is network-reachable with low attack complexity and requires only existing low-level credentials, yielding high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis; the issue was self-reported by HCL and is not listed in CISA KEV.