Medium severity5.4NVD Advisory· Published Aug 5, 2026· Updated Aug 28, 2026

CVE-2026-21766

Description

The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases and specific configurations, sensitive information may be written to web server logs. This only affects applications using the default login portlet.

Affected products

HCL Software/Digital Experiencellm-create
HCL Software/Digital Experience Composellm-create

Patches

Vulnerability mechanics

References

support.hcl-software.com/csmnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000