HCL Digital Experience EUVD-2026-34787

User interaction is required - the victim must follow a crafted link or request that carries the injected Host header value (CVSS UI:R). The attack is unauthenticated (CVSS PR:N) and remotely exploitable with low attack complexity (AV:N/AC:L), meaning no special network position or prior foothold is required. The primary limiting factor is social engineering: exploitation depends on convincing a target user to interact with a crafted URL. No special non-default configuration, specific feature flag, or particular deployment mode is described as a prerequisite in the available data. The Changed scope (S:C) confirms that once the victim interacts, impact extends to the user's browser context beyond the application boundary. Deployments with strict outbound URL controls or security-aware user populations reduce practical exploitation risk.

The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) presents a remotely exploitable, low-complexity attack requiring no privileges - but user interaction (UI:R) is a meaningful limiting factor that reduces automated mass exploitation risk. No EPSS score was provided, and the absence of a KEV listing combined with no known public POC suggests exploitation has not been observed at scale. The real-world priority is moderate: open redirect vulnerabilities are frequently used as a trusted-domain lure in phishing campaigns and OAuth token-stealing attacks rather than as standalone high-impact exploits. The Changed scope elevates the CVSS baseline, but practical confidentiality and integrity impacts are low and context-dependent. This is a real but not emergency-tier issue - prioritize patching during the next scheduled maintenance window rather than emergency response, unless the deployment is high-value and the user population is phishing-targeted.

An attacker crafts a legitimate-looking URL pointing to the target organization's HCL Digital Experience portal but includes a manipulated HTTP Host header referencing an attacker-controlled domain. The link is distributed via phishing email to enterprise users; when a victim clicks it, the application trusts the injected Host header, generates a redirect to the attacker's site, and the victim - believing they are interacting with a trusted internal portal - may submit credentials or be served malware. No public POC is known at time of analysis, so exploitation requires manual crafting of the Host-injected request.