{"id":"CVE-2026-66987","kind":"vulnerability","aliases":["CVE-2026-66987"],"related":[],"title":"HCL AION: weak account lockout lets attackers brute-force user passwords","description":"HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION's account lockout does not sufficiently limit repeated failed logins. An attacker can make many password guesses against a user account and may take it over.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","other"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T16:18:58+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","triaged_at":"2026-11-06T16:44:44+00:00","updated_at":"2026-11-06T16:44:44+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T16:44:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"HCL AION: weak account lockout lets attackers brute-force user passwords","impact":"high","summary":"HCL AION's account lockout does not sufficiently limit repeated failed logins. An attacker can make many password guesses against a user account and may take it over.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hcl-aion"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"account takeover through password guessing against user accounts","analyst_note":"Check the NVD entry and HCL's advisory for affected AION versions, the fixed release, and whether the flaw depends on a specific login configuration.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000591,"input_tokens":4239,"output_tokens":334,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-66987':15A,18A 'account':4A,25B,44B,57C,82C,89C 'affect':51C 'aion':2A,21B,23B,49C 'allow':68C 'attack':7A,35B,70C,95C 'attempt':67C 'behavior':100C 'brute':9A,93C 'brute-forc':8A,92C 'certain':105C 'compromis':90C 'condit':106C 'cve':13A,16A 'fail':32B,65C 'forc':10A,94C 'guess':40B,78C 'hcl':1A,20B,22B,48C 'hcl-aion':19B 'impact':103C 'increas':85C 'larg':74C 'let':6A 'limit':30B 'lockout':5A,26B,58C 'login':33B,66C 'make':37B,72C 'mani':38B 'may':46B,84C 'mechan':59C 'number':75C 'password':12A,39B,77C 'potenti':96C 'repeat':31B,64C 'restrict':63C 'result':97C 'risk':87C 'secur':102C 'suffici':29B,62C 'take':47B 'unintend':99C 'user':11A,43B,81C 'vulner':54C 'weak':3A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","medium","other"],"campaign_type":null,"search_a":"'-2026':14A,17A '-66987':15A,18A 'account':4A 'aion':2A 'attack':7A 'brute':9A 'brute-forc':8A 'cve':13A,16A 'forc':10A 'hcl':1A 'let':6A 'lockout':5A 'password':12A 'user':11A 'weak':3A","search_b":"'account':25B,44B 'aion':21B,23B 'attack':35B 'fail':32B 'guess':40B 'hcl':20B,22B 'hcl-aion':19B 'limit':30B 'lockout':26B 'login':33B 'make':37B 'mani':38B 'may':46B 'password':39B 'repeat':31B 'suffici':29B 'take':47B 'user':43B","search_c":"'account':57C,82C,89C 'affect':51C 'aion':49C 'allow':68C 'attack':70C,95C 'attempt':67C 'behavior':100C 'brute':93C 'brute-forc':92C 'certain':105C 'compromis':90C 'condit':106C 'fail':65C 'forc':94C 'guess':78C 'hcl':48C 'impact':103C 'increas':85C 'larg':74C 'lockout':58C 'login':66C 'make':72C 'may':84C 'mechan':59C 'number':75C 'password':77C 'potenti':96C 'repeat':64C 'restrict':63C 'result':97C 'risk':87C 'secur':102C 'suffici':62C 'unintend':99C 'user':81C 'vulner':54C","first_public_at":"2026-11-06T16:18:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66987","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66987","severity":null,"published_at":"2026-11-06T16:18:58+00:00","modified_at":"2026-11-06T16:18:58+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","fetched_at":"2026-11-06T16:42:42+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}