HCL Notes CVE-2026-9007

Exploitation requires the target to be running HCL Notes Release 12.0.2FP5HF8 on Linux (RHEL 8.10, kernel 4.18.0-553.52.1.el8_10.x86_64) - other versions or platforms are not confirmed affected. The CVSS 4.0 AT:P metric indicates a specific attack-target precondition: a particular Notes web component or configuration must be active for the reflected XSS to trigger. Active victim user interaction is mandatory (UI:A) - exploitation cannot proceed without the victim navigating to a crafted URL. The attacker requires no authentication (PR:N) and the initial request is made over the network (AV:N). Exploitation is limited by: the requirement for victim interaction (no automated propagation), version specificity to a single fix pack, platform restriction to Linux deployments, and the unconfirmed AT:P precondition that narrows affected configurations beyond all running instances.

The CVSS 4.0 score of 5.5 accurately reflects a moderate-severity XSS: exploitation is network-accessible with no attacker privileges required (PR:N), but mandatory active victim interaction (UI:A) eliminates automated, wormable exploitation paths. The AT:P attack-target condition further narrows applicability beyond all deployed instances. The high subsequent-system impact scores (SC:H/SI:H/SA:H) are consistent with the sensitivity of enterprise messaging environments where Notes sessions grant access to corporate email and workflow data - successful XSS here is materially more valuable than on a generic web application. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV and no POC has been identified. Prioritization should be driven by whether affected systems expose the Notes web interface to untrusted networks and whether users interact with externally-originated links within that interface.

An attacker identifies an HCL Notes Domino web endpoint that reflects a URL parameter or form field directly into the page response without encoding. The attacker constructs a URL embedding a JavaScript payload in the vulnerable parameter and delivers it to a targeted Notes user via a phishing email or malicious link. When the victim clicks the link and their browser loads the Notes web interface, the reflected payload executes in the context of the victim's authenticated Notes session, allowing the attacker to exfiltrate session tokens or perform actions as the victim user.