What’s Vulnerable › Vulnerabilities

CVE-2025-52633: HCL AION is susceptible to Missing Content-Security-Policy

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-539

Description

HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. This issue affects AION: 2.0.

Affected products

• HCL AION: 2.0.0

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127972

Get alerted when CVE-2025-52633 or the next vulnerability affects your stack