The vulnerability identified as CVE-2026-21766 affects HCL Digital Experience and Digital Experience Compose version 9.5. It involves insufficient protection of credentials in the default login portlet, leading to potential exposure of sensitive information in web server logs under very specific use cases and configurations. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, high attack complexity, required privileges and user interaction, and a confidentiality impact but no integrity or availability impact. No official remediation or patch has been indicated in the available data.

Sensitive credential information may be exposed in web server logs, potentially allowing unauthorized parties with access to these logs to obtain confidential data. The impact is limited to confidentiality and does not affect integrity or availability. The vulnerability requires high attack complexity, privileges, and user interaction, which reduces the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review their configurations to avoid the specific use cases that lead to sensitive information being logged. Consider disabling or replacing the default login portlet if feasible and restrict access to web server logs to trusted personnel only.