---
id: "CVE-2026-66986"
page: "https://infrastack.ai/live/CVE-2026-66986"
kind: "vulnerability"
aliases: ["CVE-2026-66986"]
title: "HCL AION: user sessions stay open too long after inactivity"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["hcl-aion", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-11-06T16:18:58+00:00"
first_seen_at: "2026-11-06T16:42:42+00:00"
updated_at: "2026-11-06T16:44:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66986", "first_seen_at": "2026-11-06T16:42:42+00:00"}]
exploit_sources: []
---

# HCL AION: user sessions stay open too long after inactivity

Link for people: https://infrastack.ai/live/CVE-2026-66986 (this .md is for agents)

HCL AION does not end user sessions after a sufficient period of inactivity. Someone with access to an unattended workstation or the same system could use the still-open session to view information or act as the user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-06T16:42:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-66986

## From the sources

HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user, potentially resulting in unintended behavior or security impact under certain conditions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_