CVE-2026-66981
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
53/100
Published: 2026-11-06
Modified: 2026-11-10
First seen: 2026-11-06
Status: active
Attack Surface
Network
Low Complexity
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
Required
S:
Changed
C:
Low
I:
Low
A:
Low
Description
HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in requests without validation. An attacker could manipulate this header to influence links, redirects or responses generated by the application, potentially resulting in unintended behavior or security impact under certain conditions.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| HCL Software | HCL AION | V 2.7.0 |
| HCL Software | HCL AION | V 2.7.0 |