Every CVE Search/ Get API key

CVE-2026-66987

HCL AION is affected by multiple security vulnerabilities.

5.3 Medium

HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

What each source reports

CVE List Score used 5.3

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Record
CVE-2026-66987
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-307
Updated
2026-11-06
EUVDEUVD-2026-118322 5.3

HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Record
EUVD-2026-118322
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-06
GitHub AdvisoriesGHSA-3pw3-fxfc-9pqv 5.3

HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently...

HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Record
GHSA-3pw3-fxfc-9pqv
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-307
Updated
2026-11-06
NVD 5.3

HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Record
CVE-2026-66987
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-307
Updated
2026-11-07

Affected products

History

History
RecordedChangedSources
publishedEUVD
publishedEUVD
aliases, referencesGitHub Advisories, NVD
aliases, products, publishedEUVD
first indexedCVE List

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-66987 is a medium vulnerability (CVSS 5.3) in Hcl Aion, published November 6, 2026. No source lists public exploit code. No source names a fixed version.

References

MoveEnter Open