CVE-2025-52626

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A Potential Command Injection vulnerability in HCL AION. 

An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Feb 3, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-526277.5Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potCVE-2025-526288.8HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-sitCVE-2025-526296.1HCL AION is susceptible to Missing Content-Security-Policy.  An The absence of a CSP header may increase the risk of cross-site scripting aCVE-2025-52634.3Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnCVE-2025-526307.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-526318.1HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connectionCVE-2025-526327.5A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-526335.3HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in pCVE-2025-526347.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.CVE-2025-526359.8A rusted types in scripts not enforced in CSP vulnerability has been identified in HCL AION.This issue affects AION: 2.0.CVE-2025-526367.5HCL AION is affected by a vulnerability related to the handling of upload size limits. Improper control or validation of upload sizes may alCVE-2025-526377.3HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Impro
CVE-2025-52626: Critical severity, CVSS 9.8 | Vulnix