{"id":"CVE-2026-35109","kind":"vulnerability","aliases":["CVE-2026-35109"],"related":[],"title":"HCL AION: HTTPS pages cached by browsers and proxies expose sensitive data","description":"HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive information in cached responses may be retrieved by an unauthorized user with access to the cache, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION serves some pages over HTTPS in a way that lets the browser or an intermediate proxy store them in a cache. Someone who can read that cache may retrieve sensitive information from the cached responses.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","hcl-aion","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T14:17:12+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","triaged_at":"2026-11-06T14:43:48+00:00","updated_at":"2026-11-06T14:43:48+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-06T14:43:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HCL AION: HTTPS pages cached by browsers and proxies expose sensitive data","impact":"low","summary":"HCL AION serves some pages over HTTPS in a way that lets the browser or an intermediate proxy store them in a cache. Someone who can read that cache may retrieve sensitive information from the cached responses.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["hcl-aion","enterprise"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Sensitive data from cached responses is read by an unauthorized user","analyst_note":"Find HCL's advisory for CVE-2026-35109 to get affected versions, fixed versions and the required cache-control headers or settings.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organisations running HCL AION where sensitive pages can end up in shared or browser caches. The sources do not name affected versions or the conditions under which caching occurs, so the exact exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000641,"input_tokens":4224,"output_tokens":437,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-35109':15A,18A 'access':95C 'affect':64C 'aion':2A,22B,25B,62C 'behavior':103C 'browser':7A,37B,78C 'cach':5A,46B,52B,59B,75C,85C,98C 'certain':108C 'condit':109C 'could':73C 'cve':13A,16A 'data':12A 'enterpris':19B 'expos':10A 'hcl':1A,21B,24B,61C 'hcl-aion':20B 'https':3A,30B,72C 'impact':106C 'inform':56B,83C 'intermedi':40B,80C 'let':35B 'may':53B,87C 'page':4A,28B,69C 'potenti':99C 'proxi':9A,41B,81C 'read':50B 'respons':60B,86C 'result':100C 'retriev':54B,89C 'secur':105C 'sensit':11A,55B,82C 'serv':26B,70C 'someon':47B 'store':42B 'unauthor':92C 'unintend':102C 'user':93C 'vendor':23B 'vulner':67C 'way':33B","nicknames":[],"mitigations":[],"who_affected":"Organisations running HCL AION where sensitive pages can end up in shared or browser caches. The sources do not name affected versions or the conditions under which caching occurs, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["enterprise","hclaion","low","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-35109':15A,18A 'aion':2A 'browser':7A 'cach':5A 'cve':13A,16A 'data':12A 'expos':10A 'hcl':1A 'https':3A 'page':4A 'proxi':9A 'sensit':11A","search_b":"'aion':22B,25B 'browser':37B 'cach':46B,52B,59B 'enterpris':19B 'hcl':21B,24B 'hcl-aion':20B 'https':30B 'inform':56B 'intermedi':40B 'let':35B 'may':53B 'page':28B 'proxi':41B 'read':50B 'respons':60B 'retriev':54B 'sensit':55B 'serv':26B 'someon':47B 'store':42B 'vendor':23B 'way':33B","search_c":"'access':95C 'affect':64C 'aion':62C 'behavior':103C 'browser':78C 'cach':75C,85C,98C 'certain':108C 'condit':109C 'could':73C 'hcl':61C 'https':72C 'impact':106C 'inform':83C 'intermedi':80C 'may':87C 'page':69C 'potenti':99C 'proxi':81C 'respons':86C 'result':100C 'retriev':89C 'secur':105C 'sensit':82C 'serv':70C 'unauthor':92C 'unintend':102C 'user':93C 'vulner':67C","first_public_at":"2026-11-06T14:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35109","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35109","severity":null,"published_at":"2026-11-06T14:17:12+00:00","modified_at":"2026-11-06T14:17:12+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","fetched_at":"2026-11-06T14:42:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}