CVE-2026-21824— A privilege escalation vulnerability affects HCL Commerce
Quick assessment
Affected
HCLSoftware Commerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCLSoftware Commerce是HCLSoftware的一款电子商务平台软件。 HCLSoftware Commerce 7版本、8.x版本、9.0至9.0.1.21版本和9.1.0至9.1.19版本存在权限许可和访问控制问题漏洞，该漏洞源于权限提升，可能导致拒绝服务、泄露用户个人数据以及执行未经授权的管理操作。
Possible ATT&CK Techniques 3 AI
T1528 · Steal Application Access Token T1078 · Valid Accounts T1136 · Create AccountAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| HCLSoftware | Commerce | 7, 8.x, 9.0 - 9.0.1.21, 9.1.0 - 9.1.19, |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-21824
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
A privilege escalation vulnerability affects HCL Commerce
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权授予不正确
Source: CVE Program / CVE List V5
Vulnerability Title
HCLSoftware Commerce 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCLSoftware Commerce是HCLSoftware的一款电子商务平台软件。 HCLSoftware Commerce 7版本、8.x版本、9.0至9.0.1.21版本和9.1.0至9.1.19版本存在权限许可和访问控制问题漏洞，该漏洞源于权限提升，可能导致拒绝服务、泄露用户个人数据以及执行未经授权的管理操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCLSoftware | Commerce | 7, 8.x, 9.0 - 9.0.1.21, 9.1.0 - 9.1.19, | - |
|
II. Public POCs for CVE-2026-21824
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-21824
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-21824 (1)
IV. Related Vulnerabilities
Same product: Commerce
-
CVE-2026-55795
Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypas -
CVE-2026-32272
Craft Commerce: Blind SQL Injection via hasVariant/hasProduc -
CVE-2026-32271
Craft Commerce: SQL Injection can lead to Remote Code Execut -
CVE-2026-32270
Craft Commerce: Unauthenticated information disclosure in `c -
CVE-2026-31867
Craft Commerce has a Potential IDOR in Commerce carts
Same vendor: HCLSoftware
-
CVE-2026-67075
HCL Digital Experience is affected by improper input sanitat -
CVE-2026-67071
HCL DevOps Deploy / HCL Launch is susceptible to an Improper -
CVE-2026-21827
HCL Connections is vulnerable to an information disclosure v -
CVE-2025-62341
HCL Connections is vulnerable to server-side request forgery -
CVE-2026-21808
HCL BigFix Quantum Risk Analyzer is affected by logging sens
Same weakness: CWE-266
-
CVE-2026-103068
WordPress ByteCoreStack – MCP Connector for AI Tools plugin -
CVE-2026-103752
WordPress Authorizer plugin <= 3.15.3 - Privilege Escalation -
CVE-2026-103286
Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifica -
CVE-2026-103494
JetBrains YouTrack 2026.2.19422前权限提升漏洞 -
CVE-2026-102129
Kiteworks Core Incorrect Privilege Assignment
V. Comments for CVE-2026-21824
No comments yet