{"affected":[{"defaultStatus":"unaffected","product":"HCL AION","source":"CNA: HCL","vendor":"HCL Software","versions":[{"status":"affected","version":"Version 2.7.0"}]}],"cveId":"CVE-2026-21834","cwes":["CWE-1021"],"description":"HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks, potentially resulting in unintended behavior or security impact under certain conditions.","epss":{"date":"2026-11-10","percentile":0.04418,"score":0.00152},"exploits":[],"kev":null,"metrics":[{"score":3.1,"severity":"low","source":"CNA: HCL","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},{"score":3.1,"severity":"low","source":"NVD: psirt@hcl.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794321547436,"publishedAt":1793978585022,"references":[{"source":"CNA: HCL","tags":[],"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135217"},{"source":"psirt@hcl.com","tags":[],"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135217"}],"remediation":[],"revision":"b70e49891c3ba4ff1b66a490f2aebbc1ff849dcbb5dfa1c1340666f1475da4c7","sources":[{"modifiedAt":1794321547436,"name":"CNA: HCL","retrievedAt":1794323456834,"url":"https://www.cve.org/CVERecord?id=CVE-2026-21834"},{"modifiedAt":1794000644667,"name":"NVD","retrievedAt":1794011177668,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21834"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794323471340,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21834"}],"ssvc":{"assessedAt":1794321466026,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"HCL AION is affected by multiple security vulnerabilities.","updatedAt":1794323471340}