HCL Digital Experience EUVD-2026-34786

Exploitation requires network reachability to the HCL Digital Experience portal's Digital Asset Management API and a valid authenticated session at low privilege level (CVSS PR:L), so any user account on the portal - including self-registered or federated SSO users where allowed - is sufficient; no user interaction by a victim is required (UI:N). Exploitation is limited to deployments running Digital Experience 9.5 (per EUVD) where the DAM subsystem is enabled and reachable by the attacker's account, and where the DAM API endpoints have not been restricted by network ACL or authorization policy.

Real-world risk should be treated as elevated but not maximal. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H confirms network reachability, low complexity, no user interaction, and high impact across the CIA triad - but the PR:L requirement means an attacker must already hold a low-privileged authenticated session on the DX environment, which materially limits opportunistic mass exploitation. There is no KEV listing and no EPSS score supplied in the input, and no public exploit identified at time of analysis, so this currently looks like a high-impact but not-yet-weaponized issue. The lack of an EPSS value and absence of POC references should be re-verified after publication, since command-injection bugs in enterprise portals historically attract rapid POC development; organizations exposing DX to internet-facing user populations (where low-privileged accounts are easy to obtain via self-registration or SSO federation) should treat this closer to a critical issue.

An attacker registers or compromises a low-privileged account on an internet-facing HCL Digital Experience 9.5 portal, authenticates, and sends a crafted request to a Digital Asset Management API endpoint with shell metacharacters embedded in a parameter that the backend passes into an OS command. The injected command runs as the DX application service account, allowing the attacker to read configuration files containing database and LDAP credentials, write a webshell into the portal's deployed content, and pivot to other internal systems.