CVE-2026-21833

HCL AION is affected by a vulnerability in which the Content-Security-Policy (CSP) HTTP response header is not configured. CSP helps prevent attacks such as Cross-Site Scripting (XSS) by restricting the sources from which scripts, styles, and other resources can be loaded. The absence of this header may reduce the effectiveness of browser-based security controls, potentially resulting in unintended behavior or negative security impacts under certain conditions.

• CWE-1032

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134082

Published

Oct 1, 2026

Last Modified

Oct 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21825HCL Digital Experience Compose is affected by a reflected cr…6.1
• CVE-2026-21826HCL Digital Experience and HCL Digital Experience Compose co…6.1
• CVE-2026-21827HCL Connections is vulnerable to an information disclosure v…3.1
• CVE-2026-2183A security vulnerability has been detected in Great Develope…9.8
• CVE-2026-21830HCL BigFix AEX product is affected by a vulnerability in the…3.7
• CVE-2026-21832HCL AION is affected by a vulnerability where indirect promp…4.3
• CVE-2026-21836The HCL DominoIQ RAG feature is affected by a Broken Access …6.5
• CVE-2026-21837HCL Digital Experience is affected by an OS command injectio…8.8
• CVE-2026-2184A vulnerability was detected in Great Developers Certificate…9.8
• CVE-2026-21840HCL BigFix Platform is affected by a user enumeration vulner…3.1
• CVE-2026-21848HCL BigFix Service Management is affected by a Security Misc…5
• CVE-2026-21849HCL AION is affected by a missing encryption vulnerability i…3.7