HCL Connections EUVD-2026-98341

Exploitation requires the attacker to hold a valid low-privileged authenticated account on the target HCL Connections deployment (PR:L) and requires a victim user to interact with the attacker-controlled content - viewing a page or clicking a crafted link where the injected script renders (UI:R). The specific injectable feature is not named in the description; it generically describes user-supplied content that is reflected/stored and executed in another user's browser. Key limiting factors defenders can rely on: no anonymous/unauthenticated path (an account is needed), victim interaction is mandatory, and impact is confined to the victim's browser session (cookie/credential theft and account takeover) rather than direct server compromise. There is no availability impact.

This is a moderate-severity stored/reflected cross-site scripting flaw (CWE-79) in HCL Connections with a vendor-provided CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a genuine but not top-tier priority: network attack vector and low complexity ease exploitation, but two meaningful brakes exist - PR:L means the attacker must already hold a low-privileged authenticated account, and UI:R means a victim must interact (e.g., view the malicious content or click a crafted link). The scope change (S:C) and limited confidentiality/integrity impact reflect the classic XSS pattern where injected script executes in the victim's browser context rather than compromising the server itself. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or probable near-term exploitation - this is a high-CVSS-relative-to-footprint governance issue, not an emergency. No signals conflict; the main gap is the complete absence of exploitation-probability telemetry (EPSS/KEV/POC all unprovided), so prioritization should lean on the vendor patch cadence rather than threat-intel urgency.

A low-privileged authenticated user injects a malicious script payload into a Connections field (profile, comment, blog, forum, or activity content) that is rendered to other users. When a victim such as a colleague or administrator views that content, the script executes in their browser, stealing their session/authentication cookies and letting the attacker hijack the account. No public exploit code was identified in the provided data.