3.7
Low
CVE-2026-35115 HCL AION is affected by multiple security vulnerabilities.
Description
HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:LExploitable remotely over the network, with an ordinary account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| AION | Versions not published |
Other CVEs of AION
The 14 CVEs of AION →
CVE-2026-21833
HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not…
3.7
Low
CVE-2026-21832
HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output
4.3
Medium
CVE-2025-62315
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input…
3.4
Low
CVE-2025-62318
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external…
3.7
Low