CVE-2026-66987

HCL AION permits excessive login attempts

HCL Software · HCL AION

First documented disclosure · Review checkpoint

Summary

Account lockout permits repeated password guesses. Account-guessing risk increases. The vendor rates the potential availability impact as low.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Account lockout does not sufficiently limit repeated failed sign-ins.

Conditions required

The login interface must be reachable and the actor must be able to submit repeated authentication attempts.

Potential impact

Account-guessing risk increases. The vendor rates the potential availability impact as low.

Affected versions and configurations

2.7.0.

Fix and mitigation status

2.8.0.

Practical next steps

Upgrade HCL AION to 2.8.0 and verify the affected control in the deployed interface.

Operating lesson

Enforce repeated-attempt controls and monitor authentication failures.

Evidence and limits

HCL bulletin KB0135217 was published 2026-11-06 and identifies 2.8.0 as the fix.

Sources