CVE-2026-21822 HCL Software CVE debrief

Who should care

Defenders responsible for HCL AppScan 360° installations should assess exposure and prioritize patching to prevent potential file system tampering. This includes reviewing the affected product scope, verifying the remediation status, and applying patches or mitigations as needed. Additionally, defenders should monitor file system changes and logs for suspicious activity and review compensating controls for exposed systems while remediation is scheduled and

Why it matters

Defenders should care about CVE-2026-21822 because it allows authenticated attackers to read or write files outside the intended directory in HCLSoftware AppScan 360°, potentially enabling file system tampering.

• Potential file system structure inspection
• Unauthorized file modification within the application's directory scope
• Required verification of affected versions and remediation status

Technical summary

The ASReportService component in HCLSoftware AppScan 360° is vulnerable to Path Traversal, allowing authenticated attackers to access files outside the intended directory. This vulnerability can be exploited to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope. The vulnerability is caused by improper handling of file paths in the ASReportService component, and defenders should prioritize verifying and patching affected HCL AppScan 360° installations to prevent potential file system tampering.

Defensive priority

Defenders should prioritize verifying and patching affected HCL AppScan 360° installations to prevent potential file system tampering.

Recommended defensive actions

• Verify and apply patches for HCL AppScan 360° to address the Path Traversal vulnerability
• Restrict access to the ASReportService component to minimize exposure
• Monitor file system changes and logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the Path Traversal vulnerability in HCLSoftware AppScan 360°. The vulnerability was reported by a researcher and is documented in the official CVE record and NVD entry. The affected product is HCLSoftware AppScan 360°, and the vulnerability affects its ASReportService component. The CVE record and NVD entry provide additional information on the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.