CVE-2026-21753: CWE-1104 Use of Unmaintained Third Party Components in HCL Software Hive

HCL Hive version 1.0 suffers from CWE-1104, which is the use of unmaintained third-party components due to weak software supply chain governance. This can lead to the inclusion of vulnerable or malicious dependencies within the application environment. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) reflects that exploitation requires network access, high complexity, no privileges, and user interaction, with limited confidentiality and integrity impact and no availability impact. There are no vendor advisories or patches currently available for this issue.

The vulnerability may allow attackers to compromise confidentiality and integrity of the application environment by leveraging unmaintained or malicious third-party components. However, the impact is limited due to the high attack complexity and requirement for user interaction. There is no known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should review and strengthen their software supply chain governance practices to minimize the risk of including vulnerable or malicious third-party components.