CVE-2026-21822 is a path traversal vulnerability (CWE-22) in HCL Software's AppScan 360°, specifically in the ASReportService component. The flaw arises from improper handling of file paths, enabling an authenticated attacker to access or modify files outside the designated directory boundaries. This can allow unauthorized inspection or alteration of the file system structure within the application's directory scope. The vulnerability has a CVSS 3.1 base score of 6.3, reflecting a medium severity level with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An authenticated attacker can exploit this vulnerability to read or write files outside the intended directory, potentially leading to unauthorized disclosure or modification of files within the application's directory scope. This could compromise the confidentiality, integrity, and availability of data managed by the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor HCL Software advisories for updates. In the meantime, restrict access to the ASReportService component to trusted users only and consider additional access controls to limit file system exposure.