CVE-2026-21826 HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection
Attackers can manipulate the Host header in HCL Digital Experience to cause unexpected application behavior, potentially leading to security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-21826?
CVE-2026-21826 is a medium-severity vulnerability in HCLSoftware Digital Experience & DX Compose, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways.
Weakness: CWE-601
Which versions are affected by CVE-2026-21826?
It affects 2 products.
Products include Hcltech Digital Experience, Hcltech Digital Experience Compose.
How do I fix CVE-2026-21826?
No fix has been published for CVE-2026-21826 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-21826 being exploited?
There is no known exploitation of CVE-2026-21826 in the wild and no public exploit code.
Other vulnerabilities in HCLSoftware Digital Experience & DX Compose
- CVE-2023-37538 HCL Digital Experience is susceptible to cross site scripting (XSS)
- CVE-2026-21837 HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API
- CVE-2020-14255 HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive data to unauthorized parties via crafted requests.
- CVE-2026-21825 HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center
- CVE-2025-62326 HCL Digital Experience is susceptible to stored cross-site scripting (XSS)
Sources
Also known as GHSA-xg6r-cjq3-qmj5.