CVE-2026-21849

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://localhost:8000) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35107

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the login page on logout used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-21850

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35113

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35110

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted over unencrypted connections and intercepted by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35102

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). The switch-version action redirected the browser to a dynamically constructed URL (window origin + '/workspace') without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-5345

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol (ws://test) instead of an encrypted (wss://) channel. This may allow data exchanged over the connection to be intercepted or read by an attacker on the network, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35106

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redirect to the login page in this component used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35103

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35114

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may cause content to be interpreted as an unintended type, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-35104

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-67080

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further attacks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Aex

CVE-2026-67077

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or unauthorized actions through the affected application.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Aex

CVE-2026-67074

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attackers to execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Aex

CVE-2026-67073

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Aex

CVE-2026-21830

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX product is affected by a vulnerability in the aws-sdk package.. It may cause AWS API requests to be sent to unintended or non‐AWS endpoints.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Aex

CVE-2026-67079

HCL BigFix AEX is affected by multiple security vulnerabilities.

HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthorized transactions or changes to their accounts.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Aex

CVE-2026-108015

eMudhra Compromised Certificate vulnerability impacts HCL Notes Client

Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client.  An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Notes

CVE-2026-108014

eMudhra Compromised Certificate vulnerability impacts HCL Domino Server

Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Domino Server.  An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Domino Server

CVE-2026-108013

HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)

BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Platform