VulnerabilityPublished 20 Feb 2026

CVE-2025-52603: HCLSoftware Connections · Exposure of Sensitive Information Due to Incompatible Schemas

Affects HCLSoftware ConnectionsSource CVE Database V5

Not known to be exploited · CVSS 3.5 Low.

Data as of 26 Oct 2026, 12:55 UTC

CVSS 3.1 base score

3.5Low

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: Required: Successful exploitation of this vulnerability requires a user to take some action before the vulnerability can be exploited.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 20 Feb 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
HCLSoftwareConnections	Affected =7.0, 8.0	Fixed in–

AI-suggested

Organizations should monitor HCLSoftware communications for official patches or updates addressing CVE-2025-52603 and apply them promptly once available. In the interim, administrators can review and restrict user privileges to minimize exposure, ensuring that only trusted users have access to the affected versions of HCL Connections. Conducting a thorough audit of user navigation paths and metadata exposure within the application can help identify and block the specific scenarios that trigger the vulnerability. Implementing web application firewalls (WAFs) with custom rules to detect and block anomalous requests related to metadata leakage may provide temporary protection. Additionally, organizations should educate users about safe navigation practices and the importance of reporting unusual application behavior. Reviewing and tightening schema compatibility and metadata handling in custom integrations or extensions of HCL Connections can prevent similar issues. Finally, maintaining robust monitoring and logging will help detect any attempts to exploit this vulnerability.

Description

HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.

Impact

The primary impact of CVE-2025-52603 is limited information disclosure, which could potentially aid an attacker in further reconnaissance or social engineering attacks. Since the exposed metadata is limited and the vulnerability requires authenticated access and specific user actions, the direct risk to organizations is relatively low. However, in environments where sensitive internal metadata could reveal business logic, user roles, or configuration details, this leakage might assist attackers in crafting more targeted attacks or exploiting other vulnerabilities. The vulnerability does not affect system integrity or availability, so it does not pose a risk of data tampering or service disruption. Organizations with high compliance requirements or handling sensitive data should consider this exposure significant enough to warrant remediation. The lack of known exploits reduces immediate risk, but the presence of the vulnerability in widely deployed collaboration software means it could be targeted in the future, especially in sectors relying heavily on HCL Connections for internal communication and collaboration.

CWE-213Exposure of Sensitive Information Due to Incompatible Policies (opens in a new tab)
Base weaknessOWASP Top 10 A04:2021: Insecure Design (opens in a new tab)
The product's intended functionality exposes information to certain actors in accordance with the developer's security policy, but this information is regarded as sensitive according to the intended security policies of other stakeholders such as the product's administrator, users, or others whose information is being processed.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Logging (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
V7.3.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124242 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 28 Feb 2026, 14:13 UTC

WeaknessesCWE-213

Technical details

References

Community reviews

Related threats