{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21786", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "state": "PUBLISHED", "assignerShortName": "HCL", "dateReserved": "2026-01-05T16:08:02.277Z", "datePublished": "2026-03-05T07:15:55.549Z", "dateUpdated": "2026-03-05T15:07:37.876Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Sametime for iOS", "vendor": "HCLSoftware", "versions": [{"status": "affected", "version": "< 12.0.26"}]}], "datePublic": "2026-03-05T07:15:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.</p>"}], "value": "HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-03-05T07:15:55.549Z"}, "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128949"}], "source": {"discovery": "UNKNOWN"}, "title": "HCL Sametime for iOS is affected by sensitive information disclosure", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-05T15:07:26.741434Z", "id": "CVE-2026-21786", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:07:37.876Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21786", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-05T15:07:26.741434Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-05T15:07:33.813Z"}}], "cna": {"title": "HCL Sametime for iOS is affected by sensitive information disclosure", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HCLSoftware", "product": "Sametime for iOS", "versions": [{"status": "affected", "version": "< 12.0.26"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-05T07:15:00.000Z", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128949"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.", "supportingMedia": [{"type": "text/html", "value": "<p>HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-03-05T07:15:55.549Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21786", "state": "PUBLISHED", "dateUpdated": "2026-03-05T15:07:37.876Z", "dateReserved": "2026-01-05T16:08:02.277Z", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "datePublished": "2026-03-05T07:15:55.549Z", "assignerShortName": "HCL"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:sametime:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "BA814F7C-3C88-4F73-B68E-50C166743DC5", "versionEndExcluding": "12.0.26", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs."}, {"lang": "es", "value": "HCL Sametime para iOS se ve afectado por una revelaci\u00f3n de informaci\u00f3n sensible. La informaci\u00f3n de los nombres de host se escribe en los registros de la aplicaci\u00f3n y en ciertas URL."}], "id": "CVE-2026-21786", "lastModified": "2026-03-09T18:41:33.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "psirt@hcl.com", "type": "Secondary"}]}, "published": "2026-03-05T08:15:58.163", "references": [{"source": "psirt@hcl.com", "tags": ["Vendor Advisory"], "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128949"}], "sourceIdentifier": "psirt@hcl.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "psirt@hcl.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,12.0.26)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Sametime for iOS", "source": "cna", "vendor": "HCLSoftware"}, "product": "sametime_for_ios", "vendor": "hclsoftware"}], "analysis": {"en": {"generated_at": "2026-04-16T12:30:08.898799+00:00", "value": {"mitigation_remediation": ["Update the Sametime for iOS application to the latest version provided by HCL that removes hostname disclosure from logs and URLs.", "Configure the application or device logging level to a secure level that excludes hostnames, or apply a masking filter to log entries and URLs before they are stored or transmitted.", "Regularly audit and sanitize logs and network traffic to ensure that no hostnames are exposed, and apply network or application\u2011level blocking of URLs that reveal internal hostnames if possible."], "summary": {"action": "Assess", "impact": "Sensitive information disclosure"}, "threat_synthesis": {"affected_systems": "The affected product is HCL Software\u2019s Sametime for iOS. No specific version range is provided, so all installations of this mobile collaboration app should be considered vulnerable unless a later release contains a fixed logging configuration.", "description_and_impact": "This vulnerability allows hostnames to be written in both application logs and certain URLs, exposing sensitive information that could aid in system enumeration or mapping. It is a classic case of insecure logging that violates confidentiality by leaking environment details and is classified under CWE-532.", "risk_and_exploitability": "The CVSS score of 3.3 indicates a low impact, and the EPSS score of less than 1% shows a very low likelihood of exploitation as of the current data. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires the attacker to gain some level of access to the device or to intercept the logs or URLs that the application generates, so it is largely an opportunistic or local attack vector rather than a remote exploit."}}}}, "created": "2026-03-06T15:08:01.249483+00:00", "updated": "2026-04-16T12:45:35.840727+00:00", "vendors": ["hclsoftware", "hclsoftware$PRODUCT$sametime_for_ios"]}