{"id":"CVE-2026-35111","kind":"vulnerability","aliases":["CVE-2026-35111"],"related":[],"title":"HCL AION: missing CORP header lets other sites load app resources","description":"HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION does not send a correct Cross-Origin-Resource-Policy header, so other websites can load its resources. An attacker may be able to leak data across origins under certain conditions.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T14:17:12+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","triaged_at":"2026-11-06T14:43:44+00:00","updated_at":"2026-11-06T14:43:44+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-06T14:43:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HCL AION: missing CORP header lets other sites load app resources","impact":"medium","summary":"HCL AION does not send a correct Cross-Origin-Resource-Policy header, so other websites can load its resources. An attacker may be able to leak data across origins under certain conditions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hcl-aion"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Cross-origin pages read some application resources and leak data","analyst_note":"Find the affected HCL AION versions and the vendor advisory for the fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-35111.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"HCL AION is an enterprise product, so exposure depends on whether a team runs it and serves resources a cross-origin page could load. The sources do not name affected versions or the specific configuration, so the exact scope is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":4234,"output_tokens":423,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-35111':14A,17A 'abl':45B 'across':49B 'affect':57C 'aion':2A,20B,22B,55C 'allow':74C 'app':10A 'applic':75C 'attack':42B 'behavior':97C 'certain':52B,102C 'condit':53B,103C 'corp':4A,68C 'correct':27B 'cross':29B,64C,89C 'cross-origin':88C 'cross-origin-resource-polici':28B,63C 'cve':12A,15A 'data':48B,91C 'expos':85C 'hcl':1A,19B,21B,54C 'hcl-aion':18B 'header':5A,33B,69C 'impact':100C 'insecur':73C 'leak':47B 'leakag':92C 'let':6A 'load':9A,38B,79C 'may':43B,84C 'miss':3A,71C 'origin':30B,50B,65C,82C,90C 'polici':32B,67C 'potenti':93C 'resourc':11A,31B,40B,66C,76C,86C 'result':94C 'secur':99C 'send':25B 'site':8A 'unintend':96C 'vulner':60C 'websit':36B","nicknames":[],"mitigations":[],"who_affected":"HCL AION is an enterprise product, so exposure depends on whether a team runs it and serves resources a cross-origin page could load. The sources do not name affected versions or the specific configuration, so the exact scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","medium","other"],"campaign_type":null,"search_a":"'-2026':13A,16A '-35111':14A,17A 'aion':2A 'app':10A 'corp':4A 'cve':12A,15A 'hcl':1A 'header':5A 'let':6A 'load':9A 'miss':3A 'resourc':11A 'site':8A","search_b":"'abl':45B 'across':49B 'aion':20B,22B 'attack':42B 'certain':52B 'condit':53B 'correct':27B 'cross':29B 'cross-origin-resource-polici':28B 'data':48B 'hcl':19B,21B 'hcl-aion':18B 'header':33B 'leak':47B 'load':38B 'may':43B 'origin':30B,50B 'polici':32B 'resourc':31B,40B 'send':25B 'websit':36B","search_c":"'affect':57C 'aion':55C 'allow':74C 'applic':75C 'behavior':97C 'certain':102C 'condit':103C 'corp':68C 'cross':64C,89C 'cross-origin':88C 'cross-origin-resource-polici':63C 'data':91C 'expos':85C 'hcl':54C 'header':69C 'impact':100C 'insecur':73C 'leakag':92C 'load':79C 'may':84C 'miss':71C 'origin':65C,82C,90C 'polici':67C 'potenti':93C 'resourc':66C,76C,86C 'result':94C 'secur':99C 'unintend':96C 'vulner':60C","first_public_at":"2026-11-06T14:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35111","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35111","severity":null,"published_at":"2026-11-06T14:17:12+00:00","modified_at":"2026-11-06T14:17:12+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","fetched_at":"2026-11-06T14:42:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}