EUVD-2026-44706
GHSA-3fq3-hrxw-v9q9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable reflected XSS with no attacker privileges; scope changes to victim browser; C:L/I:L reflects typical XSS session-theft impact without confirmed full takeover evidence.
Primary rating from Vendor (TCS-CERT).
CVSS VectorVendor: TCS-CERT
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected
Cross-Site Scripting (XSS). Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of another user.
This issue affects HCL Notes: Release 12.0.2FP5HF8 on Linux 4.18.0-553.52.1.El8_10.X64_64#1.
AnalysisAI
Reflected cross-site scripting in HCL Notes 12.0.2FP5HF8 enables unauthenticated network attackers to inject and execute arbitrary JavaScript in the browser sessions of targeted users who interact with malicious links. The CVSS 4.0 vector (SC:H/SI:H/SA:H) signals high downstream impact on victim sessions - including potential session hijacking, credential theft, and unauthorized action execution within the Notes web environment. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
HCL Notes (formerly Lotus Notes) is an enterprise collaboration and messaging platform from HCL Software, commonly deployed with an HCL Domino backend exposing a web interface (iNotes/Domino web access). The vulnerable component is a web-facing request handler that reflects user-supplied input in HTTP responses without adequate output encoding or sanitization. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause class: the application fails to escape special HTML and JavaScript characters before embedding attacker-controlled data into rendered page content. The specific affected build is Release 12.0.2FP5HF8 running on Red Hat Enterprise Linux 8.10 (kernel 4.18.0-553.52.1.el8_10.x86_64), as enumerated in CPE cpe:2.3:a:hcl_software:hcl_notes:*:*:*:*:*:*:*:*. The CVSS 4.0 AT:P metric indicates an attack-target precondition - a specific Notes component or configuration must be present for exploitation to succeed.
RemediationAI
No vendor-released patch or specific fix version has been identified in the available data. Organizations running HCL Notes 12.0.2FP5HF8 on RHEL 8.10 should contact HCL Software support directly and review the HCL Security advisories portal for available fix packs or hotfixes targeting CVE-2026-9007. As a compensating control, restricting the Domino web interface (iNotes) to trusted internal networks or VPN-only access eliminates the network-accessible attack surface; the trade-off is that remote web access becomes unavailable to users not on VPN. Deploying HTTP Content Security Policy (CSP) headers on the Domino web server can constrain script execution even if a payload is injected, though improper CSP configuration may degrade Notes web functionality. User awareness training discouraging interaction with unsolicited or externally-sourced URLs in the Notes web context provides a low-cost marginal reduction in exploitation likelihood.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today