HCL AION EUVD-2026-90966

The missing CSP header has no direct impact by itself - exploitation requires a separate, independently exploitable content-injection or Cross-Site Scripting vulnerability in HCL AION whose payload would otherwise have been blocked or constrained by a CSP. Limiting factors: a victim must load the affected AION web interface in a browser, a distinct injection vector must already exist, and the CVSS AC:H plus C:L/I:N/A:N profile indicates only partial confidentiality exposure under these chained conditions rather than standalone compromise.

This is a low-severity, defense-in-depth hardening gap rather than a directly exploitable flaw. The CVSS 3.1 score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects that the missing Content-Security-Policy header provides no impact on its own - it only weakens a browser-side mitigation that would otherwise reduce the blast radius of a separate injection (XSS) vulnerability. High attack complexity (AC:H) and the fact that only a low confidentiality impact (C:L) with no integrity or availability impact are claimed signal that exploitation requires another, independent flaw to actually be present and triggered. No EPSS score, KEV listing, or POC was provided in the input: there is no public exploit identified at time of analysis and no evidence of active exploitation. This is a genuine but low-priority item - remediate as part of routine security-header hardening, not as an emergency. The CWE (CWE-1032, incomplete/ineffective access control via missing header) is consistent with the description and the 'XSS' tag reflects the class of attack CSP is meant to mitigate, not a confirmed XSS in AION itself.

Because AION omits the Content-Security-Policy response header, a browser will not restrict the origins from which scripts and other resources load, so if an attacker can inject markup through a separate (not-yet-identified) input-handling flaw, injected JavaScript executes without CSP as a backstop. No public proof-of-concept was provided, and exploitation depends on the existence of a distinct injection vector plus a victim loading the affected page in a browser. The high attack complexity reflects this dependency on a chained condition rather than standalone exploitation.