The vulnerability arises from HCL Nomad server on Domino not configuring a default frame-ancestors directive in its Content‑Security‑Policy header. This omission allows an attacker to embed the server’s web pages in a frame or iframe on a malicious site, potentially leading to sensitive information exposure or other unspecified attack vectors. The weakness is identified as a missing security policy header, consistent with CWE‑1021 (Missing Expected Control Path).

The affected product is HCLSoftware’s Nomad server on Domino. No specific product version is listed in the CNA data, so the issue may apply to all releases of this product until a fix is issued.

The CVSS score of 3.7 indicates a low severity. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of widespread exploitation. An attacker would need to serve a malicious page that frames the Nomad server, leveraging the missing frame‑ancestors directive. Given the low severity and exploit probability, the risk is moderate but mitigable.