CVE-2026-21837: HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API

Synopsis

OS command injection in HCL Digital Experience's Digital Asset Management API allows a network-accessible attacker with a low-privilege account to execute arbitrary operating system commands. The vulnerability is reachable over the network and requires no victim interaction, with the injected commands running under the privileges of the application process. Successful exploitation gives the attacker full control over the host system and access to all data it holds. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment HCL publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Digital Asset Management API over the network; the service must be exposed to an adjacent or public network segment.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need administrative credentials to reach the vulnerable API endpoint.

• Victim interactionNot required

  No user action is needed; the attacker sends a crafted request directly to the API without involving any other party.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions or race conditions are required to trigger the command injection.

Blast Radius

• Executes arbitrary OS commands under the application process account, which the vendor notes typically leads to complete system takeover.
• Reads, exfiltrates, or destroys all files and data accessible to the application user on the host filesystem.
• Modifies or deletes stored digital assets and configuration data managed by the Digital Asset Management API.
• Disrupts availability of the Digital Experience platform by terminating processes or corrupting runtime state.