CVE-2026-67075: HCL Digital Experience is affected by improper input sanitation
Published Oct 1, 2026
·Updated
HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain. Apply HCL Digital Experience 9.5 CF238 or later to address this.
Affected Software
1 affected component
HCL Digital Experience<9.5 CF238
Event History
Oct 1, 2026
CVE Published
via MITRE·05:20 AM
Data Sourced
via MITRE·05:20 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker must be able to induce a user to interact with maliciously crafted HTML content. No attacker privileges are required, but user interaction is required.
2
What is the practical impact?
Successful exploitation can inject HTML that spoofs content served from a trusted HCL Digital Experience domain. The provided impact assessment indicates integrity impact, with no stated confidentiality or availability impact.
3
Which remediation level addresses the issue?
Apply HCL Digital Experience 9.5 CF238 or a later cumulative fix level.