CVE-2026-21825 is a reflected cross-site scripting (XSS) vulnerability in HCLSoftware's DX Compose product, specifically affecting version 9.5. The vulnerability exists in the search center component, where user input is not properly sanitized or neutralized before being included in web pages. This flaw enables attackers to inject and execute arbitrary JavaScript code in the browsers of users who access the affected search functionality. The CVSS vector indicates the attack can be performed remotely without privileges and requires user interaction, with a scope change and partial impact on confidentiality and integrity but no impact on availability. No known exploits are reported in the wild, and no official remediation or patch has been announced by HCLSoftware.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This may lead to unauthorized disclosure of information, session hijacking, or other client-side impacts affecting confidentiality and integrity. The vulnerability does not impact system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been provided by HCLSoftware, users should monitor for updates from the vendor. Until a patch is available, consider applying web application firewall (WAF) rules or input validation controls to mitigate reflected XSS attacks in the search center component. Avoid clicking on suspicious links that may trigger the vulnerability.