{"id":"CVE-2026-66986","kind":"vulnerability","aliases":["CVE-2026-66986"],"related":[],"title":"HCL AION: user sessions stay open too long after inactivity","description":"HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION does not end user sessions after a sufficient period of inactivity. Someone with access to an unattended workstation or the same system could use the still-open session to view information or act as the user.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T16:18:58+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","triaged_at":"2026-11-06T16:44:49+00:00","updated_at":"2026-11-06T16:44:49+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-06T16:44:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"HCL AION: user sessions stay open too long after inactivity","impact":"medium","summary":"HCL AION does not end user sessions after a sufficient period of inactivity. Someone with access to an unattended workstation or the same system could use the still-open session to view information or act as the user.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["hcl-aion","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Another person with system access acts as the logged-in user","analyst_note":"Check the HCL AION advisory for affected versions, the session timeout setting, and the fixed release.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run HCL AION and let users sign in from shared or unattended machines are the ones exposed. The sources do not say which AION versions or session settings are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000617,"input_tokens":4221,"output_tokens":389,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-66986':13A,16A 'access':39B,93C 'act':59B 'action':103C 'affect':66C 'aion':2A,19B,25B,64C 'anoth':90C 'authent':84C 'behalf':105C 'behavior':113C 'certain':118C 'condit':119C 'could':48B,86C 'cve':11A,14A 'end':28B 'expir':75C 'hcl':1A,18B,24B,63C 'hcl-aion':17B 'host':22B 'impact':116C 'inact':10A,36B,81C 'inform':57B,100C 'long':8A 'open':6A,53B 'perform':102C 'period':34B,79C 'person':91C 'potenti':109C 'result':110C 'secur':115C 'self':21B 'self-host':20B 'session':4A,30B,54B,72C,85C 'someon':37B 'stay':5A 'still':52B 'still-open':51B 'suffici':33B,78C 'system':47B,97C 'unattend':42B,83C 'unintend':112C 'use':49B,88C 'user':3A,29B,62B,71C,108C 'vendor':23B 'view':56B,99C 'vulner':69C 'workstat':43B","nicknames":[],"mitigations":[],"who_affected":"Teams that run HCL AION and let users sign in from shared or unattended machines are the ones exposed. The sources do not say which AION versions or session settings are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","low","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-66986':13A,16A 'aion':2A 'cve':11A,14A 'hcl':1A 'inact':10A 'long':8A 'open':6A 'session':4A 'stay':5A 'user':3A","search_b":"'access':39B 'act':59B 'aion':19B,25B 'could':48B 'end':28B 'hcl':18B,24B 'hcl-aion':17B 'host':22B 'inact':36B 'inform':57B 'open':53B 'period':34B 'self':21B 'self-host':20B 'session':30B,54B 'someon':37B 'still':52B 'still-open':51B 'suffici':33B 'system':47B 'unattend':42B 'use':49B 'user':29B,62B 'vendor':23B 'view':56B 'workstat':43B","search_c":"'access':93C 'action':103C 'affect':66C 'aion':64C 'anoth':90C 'authent':84C 'behalf':105C 'behavior':113C 'certain':118C 'condit':119C 'could':86C 'expir':75C 'hcl':63C 'impact':116C 'inact':81C 'inform':100C 'perform':102C 'period':79C 'person':91C 'potenti':109C 'result':110C 'secur':115C 'session':72C,85C 'suffici':78C 'system':97C 'unattend':83C 'unintend':112C 'use':88C 'user':71C,108C 'view':99C 'vulner':69C","first_public_at":"2026-11-06T16:18:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66986","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66986","severity":null,"published_at":"2026-11-06T16:18:58+00:00","modified_at":"2026-11-06T16:18:58+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","fetched_at":"2026-11-06T16:42:42+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}