Is CVE-2026-21826 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21826 being exploited in the wild.

How severe is CVE-2026-21826?

Medium severity, with a CVSS score of 6.1, published 5 June 2026.

Is there a fix for CVE-2026-21826?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-21826 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-21826?

Check whether you run HCL Digital Experience or HCL Digital Experience Compose. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21826: HCL Digital Experience Host header injection

CVE-2026-21826 · Severity: medium · CVSS 6.1 · Published 2026-06-05

HCL Digital Experience, a platform used for building and managing digital content and customer portals, is vulnerable to a security flaw where an attacker can manipulate web request headers. This could allow an attacker to redirect users to malicious websites or cause the application to behave unexpectedly. Such an exploit could be used in phishing campaigns to steal user credentials or damage the organization's reputation by misusing the trusted domain.

Technologies: HCL Digital Experience, HCL Digital Experience Compose. Vendors: HCL.

Quick answers

Is CVE-2026-21826 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21826 being exploited in the wild.
How severe is CVE-2026-21826?: Medium severity, with a CVSS score of 6.1, published 5 June 2026.
Which products and versions are affected?: HCL Digital Experience; HCL Digital Experience Compose.
Is there a fix for CVE-2026-21826?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21826 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-21826?: Check whether you run HCL Digital Experience or HCL Digital Experience Compose. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

HCL Digital Experience and HCL Digital Experience Compose are vulnerable to Host header injection (CWE-601). The vulnerability arises because the application fails to properly validate the 'Host' header in incoming HTTP requests. A remote, unauthenticated attacker can exploit this by sending a specially crafted request with a manipulated Host header. If successful, this can lead to Open Redirection, where a user is redirected to an untrusted external site, or other unexpected application behaviors. Exploitation requires some level of user interaction (UI:R). HCL has released a security bulletin (KB0130849) addressing this issue.

Affected products

HCL Digital Experience
HCL Digital Experience Compose

Timeline

2026-06-05: disclosed
2026-06-05: advisory

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.