# CVE-2026-67165: HCL Connections cross-site scripting in browser

Source: https://junglewise.ai/threats/cve-2026-67165-hcl-connections-is-vulnerable-to-a-cross-site-scripting-attack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-67165 · Severity: medium · CVSS 5.4 · Published 2026-10-13

HCL Connections, a collaboration and social networking platform, contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into users' browsers. An attacker exploiting this issue could steal session cookies and authentication credentials, leading to account compromise and potential unauthorized access to sensitive corporate data.

Vendors: [HCL](https://junglewise.ai/threats/vendors/hcl).

## Quick answers

**Is CVE-2026-67165 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67165 being exploited in the wild.

**How severe is CVE-2026-67165?** Medium severity, with a CVSS score of 5.4, published 13 October 2026.

**Which products and versions are affected?** HCL Connections.

**Is there a fix for CVE-2026-67165?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-67165 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67165?** Check whether you run HCL Connections. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting flaw in HCL Connections that allows arbitrary script execution in a user's browser via an unauthenticated or low-privilege network vector. An attacker can craft a malicious payload to steal cookie-based authentication credentials and hijack user sessions, potentially enabling further compromise of the collaboration platform and connected systems.

## Affected products

- HCL Connections

## Timeline

- 2026-10-13: disclosed

## References

- [https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134059](https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134059)