CVE-2026-21754

MediumCVSS 5.4/10Last modified Sep 28, 2026

Description

HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movement, container breakout, and sensitive data exposure within internal communications.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1004

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-217555.3HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attack CVE-2026-217567.2HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, ma CVE-2026-217583.7HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the h CVE-2026-217594.3HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive CVE-2026-21768.8A security vulnerability has been detected in code-projects Contact Management System 1.0. This issue affects some unknown processing of the CVE-2026-217604.6HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks CVE-2026-217615.4HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized c CVE-2026-217625.3HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-bas CVE-2026-217644.3HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result CVE-2026-217657.8HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows CVE-2026-217665.4The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very CVE-2026-217673.3HCL BigFix Platform is affected by insufficient authentication. The application might allow users to access sensitive areas of the applicat