{"id":"CVE-2026-35110","kind":"vulnerability","aliases":["CVE-2026-35110"],"related":[],"title":"HCL AION: not all requests forced over HTTPS, traffic can be intercepted","description":"HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION does not enforce encrypted HTTPS for every request, so some traffic can travel unencrypted. An attacker on the network path could intercept data sent over those connections.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T14:17:12+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","triaged_at":"2026-11-06T14:43:36+00:00","updated_at":"2026-11-06T14:43:36+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T14:43:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HCL AION: not all requests forced over HTTPS, traffic can be intercepted","impact":"medium","summary":"HCL AION does not enforce encrypted HTTPS for every request, so some traffic can travel unencrypted. An attacker on the network path could intercept data sent over those connections.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hcl-aion","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Credentials or data intercepted in transit by a network attacker","analyst_note":"Check the HCL vendor advisory for affected AION versions, the affected endpoints, and the fixed version; the NVD entry alone gives none of these.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run HCL AION and send requests across networks an attacker could observe. The sources do not say which endpoints or configurations are affected, so the exposure cannot be narrowed further from this signal.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000634,"input_tokens":4219,"output_tokens":424,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-35110':15A,18A 'affect':58C 'aion':2A,21B,27B,56C 'attack':43B,83C 'behavior':91C 'certain':96C 'communic':65C 'condit':97C 'connect':54B,78C 'could':48B 'cve':13A,16A 'data':50B,72C 'encrypt':31B,63C 'enforc':30B,68C 'everi':34B 'forc':6A 'hcl':1A,20B,26B,55C 'hcl-aion':19B 'host':25B 'https':8A,32B,64C 'impact':94C 'intercept':12A,49B,80C 'may':73C 'network':46B,86C 'path':47B 'potenti':87C 'request':5A,35B,71C 'result':88C 'secur':93C 'self':24B 'self-host':23B 'sent':51B 'traffic':9A,38B 'transmit':75C 'travel':40B 'unencrypt':41B,77C 'unintend':90C 'vulner':61C","nicknames":[],"mitigations":[],"who_affected":"Teams that run HCL AION and send requests across networks an attacker could observe. The sources do not say which endpoints or configurations are affected, so the exposure cannot be narrowed further from this signal.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-35110':15A,18A 'aion':2A 'cve':13A,16A 'forc':6A 'hcl':1A 'https':8A 'intercept':12A 'request':5A 'traffic':9A","search_b":"'aion':21B,27B 'attack':43B 'connect':54B 'could':48B 'data':50B 'encrypt':31B 'enforc':30B 'everi':34B 'hcl':20B,26B 'hcl-aion':19B 'host':25B 'https':32B 'intercept':49B 'network':46B 'path':47B 'request':35B 'self':24B 'self-host':23B 'sent':51B 'traffic':38B 'travel':40B 'unencrypt':41B","search_c":"'affect':58C 'aion':56C 'attack':83C 'behavior':91C 'certain':96C 'communic':65C 'condit':97C 'connect':78C 'data':72C 'encrypt':63C 'enforc':68C 'hcl':55C 'https':64C 'impact':94C 'intercept':80C 'may':73C 'network':86C 'potenti':87C 'request':71C 'result':88C 'secur':93C 'transmit':75C 'unencrypt':77C 'unintend':90C 'vulner':61C","first_public_at":"2026-11-06T14:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35110","severity":null,"published_at":"2026-11-06T14:17:12+00:00","modified_at":"2026-11-06T14:17:12+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","fetched_at":"2026-11-06T14:42:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}