TI-2026-85979 Aliases CVE-2026-66986 GHSA-7vqr-cr2j-43p7

Insufficient session expiration in HCL AION lets others reuse sessions

LOW 15CWE-613Published 2026-11-06 · Updated 2026-11-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

HCL AION Version 2.7.0 does not expire user sessions after a sufficient period of inactivity, which is weakness CWE-613. A person with access to the same system can use an unattended authenticated session to view information or perform actions as the user, under certain conditions.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user, potentially resulting in unintended behavior or security impact under certain conditions.

Why it matters now

EPSS 0.00102 0th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HCL Software	HCL AION	Version 2.7.0	—	No fix listed	CNA

HCL AION VendorHCL Software Affected Version 2.7.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for HCL AION.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

2026-11-06 Threatist record created from CVE-2026-66986
2026-11-06 Alias added: GHSA-7vqr-cr2j-43p7

References

Other 1

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135217

TI-2023-24505 Path Traversal which allows file upload capability affects DRYiCE MyXalytics CVSS 3.1CRITICAL 9.8
TI-2022-22044 Out-of-bounds write in HCL Software Notes CVSS 3.1CRITICAL 9.8
TI-2022-22043 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
TI-2022-22042 Out-of-bounds write in HCL Software Notes CVSS 3.1CRITICAL 9.8
TI-2022-22041 Out-of-bounds write in HCL Software Domino CVSS 3.1CRITICAL 9.8
TI-2022-22040 Out-of-bounds write in HCL Software Notes CVSS 3.1CRITICAL 9.8

See all 661 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences