CVE-2026-67165: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in HCLSoftware Connections

HCL Connections contains a CWE-79 improper neutralization of input vulnerability during web page generation, enabling cross-site scripting attacks. An attacker can exploit this flaw to inject and execute malicious scripts in the context of a victim's browser session. This may result in theft of authentication cookies and account compromise. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with partial confidentiality and integrity impact but no availability impact. No vendor advisory or patch information is currently available.

Successful exploitation can lead to execution of arbitrary script code in the victim's browser, potentially allowing attackers to steal cookie-based authentication credentials and compromise user accounts. This can facilitate further attacks within the affected environment. The impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted content and avoid clicking suspicious links. Monitor official HCLSoftware channels for updates.