The vulnerability in HCL AION is triggered when certain operations cause out-of-band interactions that can lead to unintended exposure of sensitive information. This flaw aligns with CWE-201, indicating the application may act as a conduit for communicating data to external systems. The description states that data could be disclosed to external systems under specific conditions, thereby potentially compromising confidentiality.

HCL AION is the only product identified as affected. No specific version details are provided, meaning any deployment of this product could be susceptible until a patched or mitigated release becomes available.

The CVSS score of 5.1 rates the vulnerability as medium severity, emphasizing a confidentiality impact. EPSS information is not available, leaving the probability of exploitation uncertain. The fault appears to rely on the application initiating out‑of‑band connections, so the attack vector is inferred to be external‑side, dependent on certain operations being performed. The flaw is not listed in CISA KEV, suggesting that known, widespread exploitation has not yet been reported.