{"id":"CVE-2026-35114","kind":"vulnerability","aliases":["CVE-2026-35114"],"related":[],"title":"HCL AION: missing X-Content-Type-Options header lets browsers MIME-sniff responses","description":"HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may cause content to be interpreted as an unintended type, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION does not send the X-Content-Type-Options header correctly, so browsers may guess the content type of responses. An attacker could get the browser to interpret content as a type the site did not intend, with unintended behavior as the result.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T13:17:30+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","triaged_at":"2026-11-06T13:43:15+00:00","updated_at":"2026-11-06T13:43:15+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-06T13:43:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HCL AION: missing X-Content-Type-Options header lets browsers MIME-sniff responses","impact":"low","summary":"HCL AION does not send the X-Content-Type-Options header correctly, so browsers may guess the content type of responses. An attacker could get the browser to interpret content as a type the site did not intend, with unintended behavior as the result.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["hcl-aion"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"browser interprets content as an unintended type, causing unintended behavior","analyst_note":"Check the HCL AION advisory and NVD entry for affected versions, fixed versions and whether the header issue is reachable in default configuration.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00061,"input_tokens":4222,"output_tokens":376,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-35114':18A,21A 'affect':74C 'aion':2A,24B,27B,72C 'allow':90C 'attack':49B 'behavior':67B,112C 'browser':11A,40B,53B,91C 'caus':99C 'certain':117C 'condit':118C 'content':6A,34B,44B,56B,82C,100C 'correct':38B 'could':50B 'cve':16A,19A 'get':51B 'guess':42B 'hcl':1A,23B,26B,71C 'hcl-aion':22B 'header':9A,37B,85C 'impact':115C 'insecur':89C 'intend':64B 'interpret':55B,103C 'let':10A 'may':41B,98C 'mime':13A,94C 'mime-sniff':12A,93C 'miss':3A,87C 'option':8A,36B,84C 'potenti':108C 'respons':15A,47B,96C 'result':70B,109C 'secur':114C 'send':30B 'site':61B 'sniff':14A,95C 'type':7A,35B,45B,59B,83C,107C 'unintend':66B,106C,111C 'vendor':25B 'vulner':77C 'x':5A,33B,81C 'x-content-type-opt':4A,32B,80C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","low","vendor"],"campaign_type":null,"search_a":"'-2026':17A,20A '-35114':18A,21A 'aion':2A 'browser':11A 'content':6A 'cve':16A,19A 'hcl':1A 'header':9A 'let':10A 'mime':13A 'mime-sniff':12A 'miss':3A 'option':8A 'respons':15A 'sniff':14A 'type':7A 'x':5A 'x-content-type-opt':4A","search_b":"'aion':24B,27B 'attack':49B 'behavior':67B 'browser':40B,53B 'content':34B,44B,56B 'correct':38B 'could':50B 'get':51B 'guess':42B 'hcl':23B,26B 'hcl-aion':22B 'header':37B 'intend':64B 'interpret':55B 'may':41B 'option':36B 'respons':47B 'result':70B 'send':30B 'site':61B 'type':35B,45B,59B 'unintend':66B 'vendor':25B 'x':33B 'x-content-type-opt':32B","search_c":"'affect':74C 'aion':72C 'allow':90C 'behavior':112C 'browser':91C 'caus':99C 'certain':117C 'condit':118C 'content':82C,100C 'hcl':71C 'header':85C 'impact':115C 'insecur':89C 'interpret':103C 'may':98C 'mime':94C 'mime-sniff':93C 'miss':87C 'option':84C 'potenti':108C 'respons':96C 'result':109C 'secur':114C 'sniff':95C 'type':83C,107C 'unintend':106C,111C 'vulner':77C 'x':81C 'x-content-type-opt':80C","first_public_at":"2026-11-06T13:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35114","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35114","severity":null,"published_at":"2026-11-06T13:17:30+00:00","modified_at":"2026-11-06T13:17:30+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","fetched_at":"2026-11-06T13:42:19+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}