CVE-2026-21766 is a vulnerability in HCL Digital Experience and Digital Experience Compose version 9.5 where the default login portlet insufficiently protects credentials. Under certain very specific use cases and configurations, sensitive credential information may be logged to web server logs, exposing confidential data. The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials) and CWE-532 (Information Exposure Through Log Files). The CVSS v3.1 base score is 5.4, reflecting network attack vector, high attack complexity, required privileges and user interaction, with impact on confidentiality but not integrity or availability. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

Sensitive credential information may be exposed in web server logs when using the default login portlet under specific configurations. This exposure can lead to confidentiality breaches of user credentials. There is no reported impact on integrity or availability. The vulnerability requires high attack complexity, privileges, and user interaction, limiting exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the default login portlet in configurations known to expose credentials in logs or implement logging controls to prevent sensitive data from being recorded.