CVE-2026-35115
HCL AION is affected by multiple security vulnerabilities.
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.
| CWE | CWE-200 |
| Vendor | hcl software |
| Product | aion |
| Published | Nov 6, 2026 |
| Last Updated | Nov 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for hcl software aion
Be the first to know when new low vulnerabilities affecting hcl software aion are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
Low
Affected Versions
HCL Software / AION
V 2.6.0