Multiple security vulnerabilities affect HCL AION
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-345.
Summary
HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may increase the potential security risk, as it grants elevated permissions within the container environment. Aligning container configurations with security best practices requires minimizing privileges and avoiding root-level execution wherever possible.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-52638
- 2026-10-03 Alias added: GHSA-3m9h-mw45-63hc
References
More HCL Aion vulnerabilities
- TI-2025-32727 Improper signature verification in HCL AION CVSS 3.1CRITICAL 9.8
- TI-2025-32716 Multiple security vulnerabilities affect HCL AION CVSS 3.1HIGH 7.3
Sources
- CVE-2025-52638 · CVE Program
- CVE-2025-52638 · NVD
- FIRST EPSS
- GHSA-3m9h-mw45-63hc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences