CVE-2026-21849

HCL AION uses an unencrypted web socket for GenAI traffic

HCL Software · HCL AION

First documented disclosure · Review checkpoint

Summary

Unencrypted web socket used by the generative AI interface. Data exchanged on that connection may be readable to an observer with the required access.

Severity and exploitation evidence

Low · 3.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

One connection in the generative AI interface transmits data over an unencrypted web socket.

Conditions required

An observer must be able to access traffic on the affected connection. Its configured destination is local.

Potential impact

Data exchanged on that connection may be readable to an observer with the required access.

Affected versions and configurations

2.6.0.

Fix and mitigation status

2.8.0.

Practical next steps

Upgrade HCL AION to 2.8.0 and verify the affected control in the deployed interface.

Operating lesson

Check encryption on local as well as externally addressed connections.

Evidence and limits

HCL bulletin KB0135118 was published 2026-11-04 and identifies 2.8.0 as the fix. HCL’s CVE record gives 2026-11-03 as its public date.

Sources