HTTP Security Misconfiguration in HCL AION

CVE-2026-35115

What is CVE-2026-35115?

HCL AION has a vulnerability due to the absence or improper configuration of the HTTP Strict-Transport-Security (HSTS) header. This flaw can prevent browsers from enforcing HTTPS connections, leaving the system susceptible to downgrade attacks and interception by malicious actors. Consequently, sensitive data transmitted over the web may be exposed, leading to serious security implications in various scenarios.

References