Read the docs
TI-2026-17550 Aliases CVE-2026-21837GHSA-89jh-pgw9-qrmm

OS command injection in HCL Software Digital Experience

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0092 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HCL SoftwareDigital Experience9.5—No fix listedCNA
  • Digital Experience VendorHCL Software Affected 9.5 Fixed in — No fix listed CNA

CPE configurations NVD · 67

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:digital_experience:9.5:-:*:*:*:*:*:*9.5VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf17:*:*:*:*:*:*9.5 cf17VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf171:*:*:*:*:*:*9.5 cf171VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf172:*:*:*:*:*:*9.5 cf172VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf173:*:*:*:*:*:*9.5 cf173VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf18:*:*:*:*:*:*9.5 cf18VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf181:*:*:*:*:*:*9.5 cf181VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf182:*:*:*:*:*:*9.5 cf182VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf183:*:*:*:*:*:*9.5 cf183VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf184:*:*:*:*:*:*9.5 cf184VulnerableHCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:-:*:*:*:*:*:* Versions 9.5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf17:*:*:*:*:*:* Versions 9.5 cf17 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf171:*:*:*:*:*:* Versions 9.5 cf171 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf172:*:*:*:*:*:* Versions 9.5 cf172 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf173:*:*:*:*:*:* Versions 9.5 cf173 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf18:*:*:*:*:*:* Versions 9.5 cf18 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf181:*:*:*:*:*:* Versions 9.5 cf181 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf182:*:*:*:*:*:* Versions 9.5 cf182 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf183:*:*:*:*:*:* Versions 9.5 cf183 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf184:*:*:*:*:*:* Versions 9.5 cf184 Vulnerable ·HCL Software
Show 57 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:hcltech:digital_experience:9.5:cf19:*:*:*:*:*:*9.5 cf19VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf191:*:*:*:*:*:*9.5 cf191VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf192:*:*:*:*:*:*9.5 cf192VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf193:*:*:*:*:*:*9.5 cf193VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf194:*:*:*:*:*:*9.5 cf194VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf195:*:*:*:*:*:*9.5 cf195VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf196:*:*:*:*:*:*9.5 cf196VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf197:*:*:*:*:*:*9.5 cf197VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf198:*:*:*:*:*:*9.5 cf198VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf199:*:*:*:*:*:*9.5 cf199VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf200:*:*:*:*:*:*9.5 cf200VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf201:*:*:*:*:*:*9.5 cf201VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf202:*:*:*:*:*:*9.5 cf202VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf203:*:*:*:*:*:*9.5 cf203VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf204:*:*:*:*:*:*9.5 cf204VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf205:*:*:*:*:*:*9.5 cf205VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf206:*:*:*:*:*:*9.5 cf206VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf207:*:*:*:*:*:*9.5 cf207VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf208:*:*:*:*:*:*9.5 cf208VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf209:*:*:*:*:*:*9.5 cf209VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf210:*:*:*:*:*:*9.5 cf210VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf211:*:*:*:*:*:*9.5 cf211VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf212:*:*:*:*:*:*9.5 cf212VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf213:*:*:*:*:*:*9.5 cf213VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf214:*:*:*:*:*:*9.5 cf214VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf215:*:*:*:*:*:*9.5 cf215VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf216:*:*:*:*:*:*9.5 cf216VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf217:*:*:*:*:*:*9.5 cf217VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf218:*:*:*:*:*:*9.5 cf218VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf219:*:*:*:*:*:*9.5 cf219VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf220:*:*:*:*:*:*9.5 cf220VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf221:*:*:*:*:*:*9.5 cf221VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf222:*:*:*:*:*:*9.5 cf222VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf223:*:*:*:*:*:*9.5 cf223VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf224:*:*:*:*:*:*9.5 cf224VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf225:*:*:*:*:*:*9.5 cf225VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf226:*:*:*:*:*:*9.5 cf226VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf227:*:*:*:*:*:*9.5 cf227VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf228:*:*:*:*:*:*9.5 cf228VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf229:*:*:*:*:*:*9.5 cf229VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf230:*:*:*:*:*:*9.5 cf230VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf231:*:*:*:*:*:*9.5 cf231VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf232:*:*:*:*:*:*9.5 cf232VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf233:*:*:*:*:*:*9.5 cf233VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience:9.5:cf234:*:*:*:*:*:*9.5 cf234VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:-:*:*:*:*:*:*9.5VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf224:*:*:*:*:*:*9.5 cf224VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf225:*:*:*:*:*:*9.5 cf225VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf226:*:*:*:*:*:*9.5 cf226VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf227:*:*:*:*:*:*9.5 cf227VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf228:*:*:*:*:*:*9.5 cf228VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf229:*:*:*:*:*:*9.5 cf229VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf230:*:*:*:*:*:*9.5 cf230VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf231:*:*:*:*:*:*9.5 cf231VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf232:*:*:*:*:*:*9.5 cf232VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf233:*:*:*:*:*:*9.5 cf233VulnerableHCL Software
cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf234:*:*:*:*:*:*9.5 cf234VulnerableHCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf19:*:*:*:*:*:* Versions 9.5 cf19 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf191:*:*:*:*:*:* Versions 9.5 cf191 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf192:*:*:*:*:*:* Versions 9.5 cf192 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf193:*:*:*:*:*:* Versions 9.5 cf193 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf194:*:*:*:*:*:* Versions 9.5 cf194 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf195:*:*:*:*:*:* Versions 9.5 cf195 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf196:*:*:*:*:*:* Versions 9.5 cf196 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf197:*:*:*:*:*:* Versions 9.5 cf197 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf198:*:*:*:*:*:* Versions 9.5 cf198 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf199:*:*:*:*:*:* Versions 9.5 cf199 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf200:*:*:*:*:*:* Versions 9.5 cf200 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf201:*:*:*:*:*:* Versions 9.5 cf201 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf202:*:*:*:*:*:* Versions 9.5 cf202 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf203:*:*:*:*:*:* Versions 9.5 cf203 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf204:*:*:*:*:*:* Versions 9.5 cf204 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf205:*:*:*:*:*:* Versions 9.5 cf205 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf206:*:*:*:*:*:* Versions 9.5 cf206 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf207:*:*:*:*:*:* Versions 9.5 cf207 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf208:*:*:*:*:*:* Versions 9.5 cf208 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf209:*:*:*:*:*:* Versions 9.5 cf209 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf210:*:*:*:*:*:* Versions 9.5 cf210 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf211:*:*:*:*:*:* Versions 9.5 cf211 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf212:*:*:*:*:*:* Versions 9.5 cf212 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf213:*:*:*:*:*:* Versions 9.5 cf213 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf214:*:*:*:*:*:* Versions 9.5 cf214 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf215:*:*:*:*:*:* Versions 9.5 cf215 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf216:*:*:*:*:*:* Versions 9.5 cf216 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf217:*:*:*:*:*:* Versions 9.5 cf217 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf218:*:*:*:*:*:* Versions 9.5 cf218 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf219:*:*:*:*:*:* Versions 9.5 cf219 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf220:*:*:*:*:*:* Versions 9.5 cf220 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf221:*:*:*:*:*:* Versions 9.5 cf221 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf222:*:*:*:*:*:* Versions 9.5 cf222 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf223:*:*:*:*:*:* Versions 9.5 cf223 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf224:*:*:*:*:*:* Versions 9.5 cf224 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf225:*:*:*:*:*:* Versions 9.5 cf225 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf226:*:*:*:*:*:* Versions 9.5 cf226 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf227:*:*:*:*:*:* Versions 9.5 cf227 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf228:*:*:*:*:*:* Versions 9.5 cf228 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf229:*:*:*:*:*:* Versions 9.5 cf229 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf230:*:*:*:*:*:* Versions 9.5 cf230 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf231:*:*:*:*:*:* Versions 9.5 cf231 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf232:*:*:*:*:*:* Versions 9.5 cf232 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf233:*:*:*:*:*:* Versions 9.5 cf233 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience:9.5:cf234:*:*:*:*:*:* Versions 9.5 cf234 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:-:*:*:*:*:*:* Versions 9.5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf224:*:*:*:*:*:* Versions 9.5 cf224 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf225:*:*:*:*:*:* Versions 9.5 cf225 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf226:*:*:*:*:*:* Versions 9.5 cf226 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf227:*:*:*:*:*:* Versions 9.5 cf227 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf228:*:*:*:*:*:* Versions 9.5 cf228 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf229:*:*:*:*:*:* Versions 9.5 cf229 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf230:*:*:*:*:*:* Versions 9.5 cf230 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf231:*:*:*:*:*:* Versions 9.5 cf231 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf232:*:*:*:*:*:* Versions 9.5 cf232 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf233:*:*:*:*:*:* Versions 9.5 cf233 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:digital_experience_compose:9.5:cf234:*:*:*:*:*:* Versions 9.5 cf234 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21837
  2. 2026-10-03 Alias added: GHSA-89jh-pgw9-qrmm

References

Advisory 1

  • TI-2023-19137 Cross-site scripting in HCL Software Digital Experience CVSS 3.1CRITICAL 9.3
  • TI-2020-11152 HCL Digital Experience 9.5 containers include vulnerabilities that could expose sensitive… CVSS 3.1HIGH 7.5
  • TI-2020-11138 Cross-site scripting in HCL Digital Experience CVSS 3.1MEDIUM 6.1
  • TI-2020-03560 In Digital Experience 8.5, 9.0, and 9.5, WSRP consumer is vulnerable to cross-site scripting (XSS). CVSS 3.1MEDIUM 6.1
  • TI-2026-17545 Open redirect in HCL Software Digital Experience & DX Compose CVSS 3.1MEDIUM 6.1
  • TI-2026-17544 Cross-site scripting in HCL Software DX Compose CVSS 3.1MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences