CVE-2026-66982: HCL AION is affected by multiple security vulnerabilities.

Published Nov 6, 2026

Updated

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in unintended behavior or security impact under certain conditions.

Event History

Nov 6, 2026

CVE Published

via MITRE·03:36 PM

Data Sourced

via MITRE·03:36 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Users who enter credentials into the affected HCL AION login form on a browser or system that other malicious users can access are exposed. The risk is tied to shared or otherwise accessible browsers and systems where saved form values may be retrieved.

What does an attacker need to exploit this?

An attacker needs access to the same browser or system used to enter credentials. They could then retrieve values the browser stored or suggests through autocomplete on the sensitive login fields.

How can I tell whether credentials may already be at risk?

Check browsers used to access HCL AION for saved credentials or autocomplete suggestions associated with its login form. Systems shared with untrusted users or accessed by a malicious user should be treated as potentially exposed.

CVE-2026-66982: HCL AION is affected by multiple security vulnerabilities.

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit this?

How can I tell whether credentials may already be at risk?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit this?

How can I tell whether credentials may already be at risk?