CVE-2026-21834

HCL AION does not send a content-security policy

HCL Software · HCL AION

First documented disclosure · Review checkpoint

Summary

Missing browser content-security policy. The browser has fewer checks against a separate content-injection weakness.

Severity and exploitation evidence

Low · 3.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Application responses omit the browser policy that restricts script and resource origins.

Conditions required

A browser must process attacker-influenced content for the missing safeguard to matter.

Potential impact

The browser has fewer checks against a separate content-injection weakness.

Affected versions and configurations

2.7.0.

Fix and mitigation status

2.8.0.

Practical next steps

Upgrade HCL AION to 2.8.0 and verify the affected control in the deployed interface.

Operating lesson

Verify that application responses carry a restrictive, tested content-security policy.

Evidence and limits

HCL bulletin KB0135217 was published 2026-11-06 and identifies 2.8.0 as the fix.

Sources