CVE-2026-35114

HCL AION allows browsers to infer response content types

HCL Software · HCL AION

First documented disclosure · Review checkpoint

Summary

Missing content-type policy permits browser content sniffing. A browser may interpret content in an unintended context.

Severity and exploitation evidence

Low · 3.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Responses lack the control that prevents browsers from inferring a different content type.

Conditions required

The affected response must be processed by a browser that performs content-type sniffing.

Potential impact

A browser may interpret content in an unintended context.

Affected versions and configurations

2.6.0.

Fix and mitigation status

2.8.0.

Practical next steps

Upgrade HCL AION to 2.8.0 and verify the affected control in the deployed interface.

Operating lesson

Set explicit content types and verify anti-sniffing headers.

Evidence and limits

HCL bulletin KB0135118 was published 2026-11-04 and identifies 2.8.0 as the fix.

Sources