CVE-2026-21770 describes an uncontrolled search path element vulnerability (CWE-427) in HCL Traveler for Microsoft Outlook (HTMO). This DLL hijacking vulnerability could enable an attacker who has high privileges on the system and can induce user interaction to replace or modify application DLLs with malicious ones, potentially leading to complete compromise of confidentiality, integrity, and availability of the application. The vulnerability is local attack vector with low attack complexity but requires high privileges and user interaction. No vendor advisory or patch information is currently available.

Successful exploitation could result in full compromise of the application, including unauthorized disclosure, modification, or destruction of data. The CVSS vector indicates high impact on confidentiality, integrity, and availability. However, exploitation requires local access with high privileges and user interaction, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users with high privileges and exercise caution with user interactions that could trigger DLL loading. Monitor for vendor updates regarding patches or official mitigations.