Our analysis identifies that HCL AION omits or configures an insecure X-Content-Type-Options header. Without this protection, browsers may sniff the MIME type of responses, potentially treating data content as executable script or HTML. This behavior can lead to unintended execution or presentation of content, and in certain scenarios may expose sensitive information. The weakness aligns with CWE-200, which relates to information exposure.

The vulnerability affects HCL Software’s HCL AION platform. No specific version numbers are disclosed, indicating that all deployed instances may be impacted until a patch is applied. The issue is tied to the platform’s HTTP response handling, not influenced by external configuration changes.

The CVSS score of 3.7 classifies the issue as low severity. EPSS is not available, and the vulnerability is not listed in the KEV catalog. Attackers would need the ability to interact with or view the susceptible responses, implying a potential user‑targeted attack vector involving browser interpretation. Because the vulnerability stems from the server’s omission of a protective header, enforcing the correct header or applying a patch fully mitigates the risk and removes the possibility of MIME sniffing.