CVE-2026-35115
LOW
INFO
Priority: 0.01
BB Relevance:
37/100
Published: 2026-11-06
Modified: 2026-11-06
First seen: 2026-11-06
Status: active
Attack Surface
Network
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
Required
S:
Unchanged
C:
Low
I:
None
A:
Low
Description
HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| HCL Software | AION | V 2.6.0 |
| HCL Software | AION | V 2.6.0 |