Vulnerability · Published Jun 5, 2026 · Assigned by HCL
CVE-2026-21837HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API
High 8.7
In plain English
A high-severity OS command injection in Digital Experience from HCLSoftware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.9%top 39.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API. An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCLSoftware | Digital Experience | 9.5 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N