What is the CVSS score of EUVD-2026-14986?

EUVD-2026-14986 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Traveler are affected by EUVD-2026-14986?

Organizations using HCL Traveler should be aware of moderate risk from CVE-2026-21783 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2026-14986?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Traveler EUVD-2026-14986

| CVE-2026-21783 MEDIUM

Error Message Information Leak (CWE-209)

2026-03-24 HCL

GHSA-w3p4-547j-v9cv

Information Disclosure Traveler

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

14.5.1.0

EUVD ID Assigned

Mar 24, 2026 - 20:00 euvd

EUVD-2026-14986

Analysis Generated

Mar 24, 2026 - 20:00 vuln.today

CVE Published

Mar 24, 2026 - 19:48 nvd

MEDIUM 4.3

DescriptionCVE.org

HCL Traveler is affected by sensitive information disclosure. The application generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.

AnalysisAI

HCL Traveler contains a sensitive information disclosure vulnerability where error messages expose internal system details including file paths, tokens, credentials, and stack traces. This affects all versions of HCL Traveler as indicated by the CPE string, and requires authenticated access (PR:L) to exploit but can be leveraged by low-privilege users to reconnaissance the application architecture for follow-up attacks. With a CVSS score of 4.3 and confidentiality impact rated as LOW, this is a moderate information disclosure issue that lowers the bar for subsequent targeted attacks rather than directly compromising systems.

Technical ContextAI

The vulnerability stems from CWE-209 (Information Exposure Through an Error Message), a weakness where applications fail to sanitize or suppress detailed diagnostic information in error responses. HCL Traveler, an enterprise mobility and messaging client (CPE: cpe:2.3:a:hclsoftware:traveler:*:*:*:*:*:*:*:*), generates verbose error messages during authentication failures, API errors, or backend communication issues. Rather than returning generic error codes to authenticated users, the application leaks internal path structures, component versions, token formats, database query hints, and Java stack traces. This information assists attackers in mapping the application's technology stack, identifying potential injection points, and crafting more effective social engineering or technical attacks against downstream systems.

RemediationAI

HCL Software has released patches to address this vulnerability; organizations should immediately consult https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129139 to identify the patched version for their Traveler release line and apply it. Until patching is feasible, implement compensating controls including: restrict Traveler access to trusted IP ranges and internal networks only, enforce strong authentication and session management to limit exposure to low-privilege account compromise, monitor application logs for repeated error message generation patterns that may indicate reconnaissance activity, and configure reverse proxies or web application firewalls to sanitize error responses by suppressing stack traces and internal paths before they reach clients. Additionally, review and rotate any credentials, tokens, or API keys that may have been logged in error messages during the disclosure window.