CVE-2022-38656: Hcltechsw Hcl Commerce

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes.

Affected products

• Hcltechsw Hcl Commerce: from 9.1.8, up to and including 9.1.11

Published 2022-12-12. Last modified 2026-06-17.