Vulnerability · Published Sep 18, 2026 · Assigned by HCL
CVE-2026-21822A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).
Medium 6.3
In plain English
A medium-severity path traversal in HCL AppScan 360° from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 75.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCL Software | HCL AppScan 360° | v 2.1.0 and lower |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L