CVE-2026-21812: CWE-319 Cleartext Transmission of Sensitive Information in HCL Software AppScan Integration with Azure Boards for ASoC & A360

CVE-2026-21812 describes a cleartext transmission vulnerability (CWE-319) in the HCL AppScan Azure Boards Plugin when configured to communicate with the AppScan server over HTTP. This insecure communication channel can expose sensitive credentials or authentication tokens to interception by attackers. The vendor updated the plugin to warn users when HTTP is used and recommends switching to HTTPS to secure transmissions. The vulnerability has a CVSS 3.1 base score of 2.2, indicating low severity. The product is a cloud service, and the vendor manages remediation accordingly.

An attacker able to intercept network traffic between the plugin and the AppScan server over HTTP could obtain sensitive credentials or authentication tokens. This could lead to unauthorized access if intercepted. However, the impact is limited by the requirement of network access to the HTTP channel and the low severity score.

The vendor has updated the plugin to display warnings when HTTP is used and recommends configuring the plugin to communicate over HTTPS. Since this is a cloud-hosted service, the vendor manages remediation on the server side. Users should ensure HTTPS is used to prevent interception of sensitive information. Patch status is confirmed as available.