---
id: "CVE-2026-35109"
page: "https://infrastack.ai/live/CVE-2026-35109"
kind: "vulnerability"
aliases: ["CVE-2026-35109"]
title: "HCL AION: HTTPS pages cached by browsers and proxies expose sensitive data"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["enterprise", "hcl-aion", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-06T14:17:12+00:00"
first_seen_at: "2026-11-06T14:42:11+00:00"
updated_at: "2026-11-06T14:43:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35109", "first_seen_at": "2026-11-06T14:42:11+00:00"}]
exploit_sources: []
---

# HCL AION: HTTPS pages cached by browsers and proxies expose sensitive data

Link for people: https://infrastack.ai/live/CVE-2026-35109 (this .md is for agents)

HCL AION serves some pages over HTTPS in a way that lets the browser or an intermediate proxy store them in a cache. Someone who can read that cache may retrieve sensitive information from the cached responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-06T14:42:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-35109

## From the sources

HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive information in cached responses may be retrieved by an unauthorized user with access to the cache, potentially resulting in unintended behavior or security impact under certain conditions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_