CVE-2026-35115: HCL AION is affected by multiple security vulnerabilities.

Published Nov 6, 2026

Updated

HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Configure the HSTS header so browsers are instructed to always use HTTPS.
HCL AION HTTP Strict-Transport-Security (HSTS) = enabled

Event History

Nov 6, 2026

CVE Published

via MITRE·01:09 PM

Data Sourced

via MITRE·01:09 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for this issue to be exploited?

An attacker would need to be able to interfere with or observe a user's connection in a way that enables an HTTP downgrade or interception. The issue is relevant because browsers may not be instructed to always use HTTPS.

What is the practical impact of the missing or insecure HSTS configuration?

Connections may be downgraded or intercepted, which can lead to unintended behavior or other security impact under certain conditions. The available information does not specify affected versions, configurations, or a vendor-provided mitigation.

CVE-2026-35115: HCL AION is affected by multiple security vulnerabilities.

Remediation

Event History

Frequently Asked Questions

What conditions are required for this issue to be exploited?

What is the practical impact of the missing or insecure HSTS configuration?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for this issue to be exploited?

What is the practical impact of the missing or insecure HSTS configuration?