PT-2026-5906 · Hcl+1 · Aion

Published 2026-02-03 · Updated 2026-04-27 · CVE-2025-52631

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HCL AION version 2.0

Description HCL AION is susceptible to a missing or insecure HTTP Strict-Transport-Security (HSTS) header. This can permit insecure connections, potentially exposing the application to man-in-the-middle and protocol downgrade attacks.

Recommendations Ensure that a secure HSTS header is implemented and configured correctly for HCL AION version 2.0.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-52631

Affected Products

Aion

References · 5

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127972 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52631 · Security Note
• https://t.me/cveNotify/161133 · Telegram Post
• https://t.me/cveNotify/151700 · Telegram Post