Dashboard / CVE-2026-66986

CVE-2026-66986

LOW
INFO Priority: 0.00 BB Relevance: 32/100
Published: 2026-11-06 Modified: 2026-11-10 First seen: 2026-11-06 Status: active

Attack Surface

Low Complexity No Auth

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Required
S: Unchanged
C: Low
I: None
A: None

Description

HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user, potentially resulting in unintended behavior or security impact under certain conditions.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
HCL Software HCL AION Version 2.7.0
HCL Software HCL AION Version 2.7.0

References & Advisories (1)

Bug Bounty Relevance

32 / 100
✓ No authentication
✓ Low complexity

CVSS Score

3.3 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

EPSS — Exploitation Probability

0.10%
Raw Score 0.001020
Percentile 0.9%
Date 2026-11-10

EPSS Trend

2026-11-10
0.00102
2026-11-09
0.00102
2026-11-08
0.00102
2026-11-07
0.00102

Intelligence Sources

mitre ref →
nvd ref →

External Links