{"id":"CVE-2026-66984","kind":"vulnerability","aliases":["CVE-2026-66984"],"related":[],"title":"HCL AION: some application responses reveal internal server file paths","description":"HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information could help an attacker understand the application structure and plan further attacks, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"Certain HCL AION application responses disclose internal server file system paths. An attacker can use that layout information to plan further attacks.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","other","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T16:18:57+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","triaged_at":"2026-11-06T16:44:52+00:00","updated_at":"2026-11-06T16:44:52+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T16:44:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HCL AION: some application responses reveal internal server file paths","impact":"low","summary":"Certain HCL AION application responses disclose internal server file system paths. An attacker can use that layout information to plan further attacks.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hcl-aion","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Internal server file paths exposed to an attacker, aiding further attacks","analyst_note":"Check the HCL AION security bulletin and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-66984) for affected versions, fixed version, and which responses leak paths.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"HCL AION deployments are affected, per the NVD entry. The sources do not say which configurations or response paths are involved, so the scope is unknown. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000622,"input_tokens":4196,"output_tokens":405,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-66984':13A,16A 'affect':49C 'aion':2A,19B,26B,47C 'applic':4A,27B,55C,71C 'attack':36B,45B,68C,76C 'behavior':81C 'certain':24B,54C,86C 'condit':87C 'could':65C 'cve':11A,14A 'disclos':29B 'file':9A,32B,60C 'hcl':1A,18B,25B,46C 'hcl-aion':17B 'help':66C 'host':23B 'impact':84C 'inform':41B,64C 'intern':7A,30B,58C 'layout':40B 'path':10A,34B,62C 'plan':43B,74C 'potenti':77C 'respons':5A,28B,56C 'result':78C 'reveal':6A,57C 'secur':83C 'self':22B 'self-host':21B 'server':8A,31B,59C 'structur':72C 'system':33B,61C 'understand':69C 'unintend':80C 'use':38B 'vulner':52C","nicknames":[],"mitigations":[],"who_affected":"HCL AION deployments are affected, per the NVD entry. The sources do not say which configurations or response paths are involved, so the scope is unknown. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","low","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-66984':13A,16A 'aion':2A 'applic':4A 'cve':11A,14A 'file':9A 'hcl':1A 'intern':7A 'path':10A 'respons':5A 'reveal':6A 'server':8A","search_b":"'aion':19B,26B 'applic':27B 'attack':36B,45B 'certain':24B 'disclos':29B 'file':32B 'hcl':18B,25B 'hcl-aion':17B 'host':23B 'inform':41B 'intern':30B 'layout':40B 'path':34B 'plan':43B 'respons':28B 'self':22B 'self-host':21B 'server':31B 'system':33B 'use':38B","search_c":"'affect':49C 'aion':47C 'applic':55C,71C 'attack':68C,76C 'behavior':81C 'certain':54C,86C 'condit':87C 'could':65C 'file':60C 'hcl':46C 'help':66C 'impact':84C 'inform':64C 'intern':58C 'path':62C 'plan':74C 'potenti':77C 'respons':56C 'result':78C 'reveal':57C 'secur':83C 'server':59C 'structur':72C 'system':61C 'understand':69C 'unintend':80C 'vulner':52C","first_public_at":"2026-11-06T16:18:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66984","severity":null,"published_at":"2026-11-06T16:18:57+00:00","modified_at":"2026-11-06T16:18:57+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","fetched_at":"2026-11-06T16:42:42+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}