CVE-2026-67165
5.4MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
An authenticated attacker can execute malicious scripts in a victim's browser to hijack session cookies and compromise accounts. The attack requires low-privilege network access and user interaction.
Root cause
Improper input neutralization before rendering data back to users enables stored or reflected cross-site scripting (CWE-79).
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Review HCL advisory KB0134059 for the target patch version and apply it; no interim configuration workaround is provided.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.