HCL Connections CVE-2026-21827

User interaction is required (UI:R per CVSS vector) - a victim user must perform an action as part of the attack. Attack complexity is high (AC:H), meaning conditions beyond the attacker's direct control must align, such as specific session states or request timing. The CVSS vector shows PR:N (no prior privileges required for the attacker), though this should be verified against the vendor advisory as the description does not explicitly confirm anonymous exploitability. Exploitation is meaningfully limited by: mandatory user interaction, high attack complexity, and confidentiality impact restricted to partial data disclosure (C:L) with no integrity or availability impact. No specific configuration flag or feature enablement is identified in the description as a prerequisite.

The aggregate risk signal for this vulnerability is low. The CVSS 3.1 base score of 3.1 is driven by AC:H (conditions outside attacker control must be met), UI:R (a victim user must take an action), and C:L (only limited data is exposed). There is no integrity or availability impact. No EPSS score is available in the provided data, and the vulnerability is absent from the CISA KEV catalog, with no public proof-of-concept code identified. These signals consistently indicate a low-priority issue unlikely to be exploited opportunistically. The primary real-world risk is targeted misuse by a sophisticated attacker with prior knowledge of the environment. The absence of a confirmed fixed version in the input data introduces some uncertainty about remediation status, which defenders should verify directly against the HCL advisory.

A sophisticated attacker who can engineer a specific interaction from a target user - such as clicking a crafted link or visiting a manipulated Connections page - could cause the application to respond with sensitive data belonging to other users or data beyond the requester's entitlement. The AC:H requirement means the attacker must also control or predict specific application conditions (such as timing, session state, or request sequencing) that are not entirely within attacker control. No public exploit code exists to lower this bar.