CVE-2025-68825

HCL Hive is affected by incorrect default permissions

HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Hive

CVE-2026-21759

HCL Hive is affected by an information exposure vulnerability

HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.  Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Hive

CVE-2026-21756

HCL Hive is affected by a broken access control vulnerability

HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, malicious, or broken code directly into production environments.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Hive

CVE-2026-21751

HCL Hive is affected by use of a cryptographic primitive with a risky implementation

HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Hive

CVE-2025-68833

HCL Hive is affected by use of a cryptographic primitive with a risky implementation

HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Hive

CVE-2026-21755

HCL Hive is affected by a missing rate limit

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Hive

CVE-2026-56537

HCL Connections is vulnerable to information disclosure

HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data.they are not entitled to, caused by improper handling of request data.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Connections

CVE-2026-56538

HCL Connections is vulnerable to information disclosure

An endpoint in HCL Connections is vulnerable to information disclosure. In certain scenarios this might lead to disclosing sensitive information to unauthorized users.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Connections

CVE-2025-52640

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2025-62314

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2025-62318

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2025-62315

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-21832

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-21764

Insufficient Input Validation in DevOps Loop

HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Devops Loop

CVE-2026-21760

Unauthorized Access to Admin Functionality via Forced Browsing

HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessing protected application endpoints.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Devops Loop

CVE-2026-21761

CORS Misconfiguration in DevOps Loop

HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized cross-origin requests, potentially exposing application resources to untrusted domains.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Devops Loop

CVE-2026-56620

HCL BigFix Mobile is vulnerable to information disclosure

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Mobile

CVE-2026-56619

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS)

HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Mobile

CVE-2026-21766

HCL Digital Experience and Digital Experience Compose insufficiently protects credentials

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials.  Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs.  This only affects applications using the default login portlet.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Digital Experience Compose

CVE-2026-56608

HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).

HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Icontrol