HCL DX Compose CVE-2026-21825

The search center feature of HCL Digital Experience Compose must be accessible to the attacker's crafted link - this is a standard component of the platform, so no non-default configuration is required to expose the vulnerability. The CVSS PR:N confirms the attacker requires no authentication; however, UI:R confirms the attack cannot succeed without a victim user clicking a crafted link, making social engineering or phishing the required delivery mechanism. Exploitation is therefore limited to scenarios where a user with an active session can be induced to follow a malicious URL targeting the search center endpoint. There is no evidence of exploit chains that bypass the UI:R requirement.

The CVSS 6.1 Medium score is appropriate given the combination of network reachability (AV:N), low complexity (AC:L), no required privileges (PR:N), mandatory user interaction (UI:R), changed scope (S:C), and low confidentiality and integrity impact (C:L/I:L/A:N). The practical risk to organizations deploying HCL DX Compose is moderate: the attack is simple to construct and requires no authentication on the attacker side, but delivery depends entirely on social engineering a victim into clicking a crafted link - a non-trivial barrier. No EPSS score, KEV listing, or POC exploit is available in the provided data, which is consistent with a medium-severity reflected XSS with no evidence of mass exploitation. The absence of a confirmed patch version in the available intelligence is a gap - defenders cannot confirm remediation without verifying the HCL advisory directly. CVSS vector alignment with the description is consistent: network-delivered, user-triggered, no server-side persistence.

An attacker crafts a URL targeting the DX Compose search center with a malicious JavaScript payload embedded in the search query parameter (e.g., a script that exfiltrates the victim's session cookie or authentication token). The attacker delivers this URL to a target via a phishing email or message, and when the authenticated victim clicks the link, the application reflects the unsanitized payload back in the response, executing the script in the victim's browser under the application's origin context. No public proof-of-concept exists at time of analysis, but the attack pattern is well-understood and trivially replicable by any attacker with basic XSS knowledge.