{"affected":[{"defaultStatus":"unaffected","product":"HCL AION","source":"CNA: HCL","vendor":"HCL Software","versions":[{"status":"affected","version":"Version 2.7.0"}]}],"cveId":"CVE-2026-66987","cwes":["CWE-307"],"description":"HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This may increase the risk of account compromise through brute-force attacks, potentially resulting in unintended behavior or security impact under certain conditions.","epss":{"date":"2026-11-10","percentile":0.13294,"score":0.00225},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: HCL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},{"score":5.3,"severity":"medium","source":"NVD: psirt@hcl.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1794321377861,"publishedAt":1793979460845,"references":[{"source":"CNA: HCL","tags":[],"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135217"},{"source":"psirt@hcl.com","tags":[],"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135217"}],"remediation":[],"revision":"ebea0fef0bb1f9dfdc862d7edffed9d8d957184e476e1cc7fe96e6624f5c0e45","sources":[{"modifiedAt":1794321377861,"name":"CNA: HCL","retrievedAt":1794323467311,"url":"https://www.cve.org/CVERecord?id=CVE-2026-66987"},{"modifiedAt":1794000644667,"name":"NVD","retrievedAt":1794011179345,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66987"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794323470304,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-66987"}],"ssvc":{"assessedAt":1794321367817,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"HCL AION is affected by multiple security vulnerabilities.","updatedAt":1794323470304}