CVE-2026-35109

HCL AION allows sensitive pages to remain in browser or proxy caches

HCL Software · HCL AION

First documented disclosure · Review checkpoint

Summary

Authenticated pages can remain in a shared cache. Cached responses may expose sensitive application data.

Severity and exploitation evidence

Low · 3.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Responses served over HTTPS can be retained by browsers or intermediary caches.

Conditions required

An unauthorized party must have access to a cache that retained affected content.

Potential impact

Cached responses may expose sensitive application data.

Affected versions and configurations

2.6.0.

Fix and mitigation status

2.8.0.

Practical next steps

Upgrade HCL AION to 2.8.0 and verify the affected control in the deployed interface.

Operating lesson

Check cache-control behavior on authenticated pages and intermediaries.

Evidence and limits

HCL bulletin KB0135118 was published 2026-11-04 and identifies 2.8.0 as the fix. HCL’s CVE record gives 2026-11-03 as its public date.

Sources