CVE-2026-21756: CWE-266 Incorrect privilege assignment in HCLSoftware HCL Hive

CVE-2026-21756 describes an incorrect privilege assignment vulnerability in HCLSoftware's HCL Hive product, specifically version 1.0. The flaw involves broken access control that may permit an attacker or unauthorized user with high privileges to inject malicious or unverified code into production environments, potentially compromising confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.2, indicating a high impact with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation could lead to full compromise of production environments by allowing malicious code injection, impacting confidentiality, integrity, and availability of the system. The attacker must have high privileges to exploit this vulnerability. There are no known exploits in the wild at this time.

No official patch or remediation level has been provided by HCLSoftware as of the publication date. Organizations should monitor vendor advisories for updates and apply any future patches promptly. Until a fix is available, restrict high privilege access to trusted personnel only and review access controls carefully to minimize risk.