Medium severity · published Aug 13, 2026
CVE-2025-52640
HCL AION is affected by multiple security vulnerabilities.
4.7
CVSS
0.1%
EPSS
No
On KEV
Description
HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L
Attack vector
Local
Complexity
High
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
AION · HCL Software
v2.0 · source: vendor
Affected product
AI
AION
HCL Software
More from AION
9.8
CVE-2025-55252
HCL AION is affected by a Weak Password Policy vulnerability
9.8
CVE-2025-52660
HCL AION is affected by an Host Header Injection vulnerability
9.8
CVE-2025-55251
HCL AION is affected by an Unrestricted File Upload vulnerability
7.5
CVE-2025-52659
HCL AION is affected by a Cacheable HTTP Response vulnerability
5.6
CVE-2025-62314
HCL AION is affected by multiple security vulnerabilities.