Medium severity · published Aug 13, 2026
CVE-2026-21832
HCL AION is affected by multiple security vulnerabilities.
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
AION · HCL Software
v2.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21832
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21832
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133084
More from AION
5.6
CVE-2025-62314
HCL AION is affected by multiple security vulnerabilities.
4.7
CVE-2025-52640
HCL AION is affected by multiple security vulnerabilities.
3.7
CVE-2026-21833
HCL AION is susceptible to a Missing "Content-Security-Policy" header Vulnerability (CVE-2026-21833)
3.7
CVE-2025-62318
HCL AION is affected by multiple security vulnerabilities.
3.4
CVE-2025-62315
HCL AION is affected by multiple security vulnerabilities.