CVE-2025-52640 affects HCL Software's AION product, specifically version 2.0. The vulnerability arises because the shared storage used by product components lacks sufficient access separation controls. As a result, processes that share this storage might access or alter files outside their authorized boundaries, potentially causing unintended behavior or security issues under certain conditions. The CVSS 3.1 vector indicates the attack requires local access with high complexity, high privileges, and user interaction, and impacts confidentiality, integrity, and availability at a low level.

The vulnerability could allow local processes with high privileges to read or modify files beyond their intended scope, potentially leading to unintended behavior or security impacts affecting confidentiality, integrity, and availability at a low level. However, exploitation requires local access, high privileges, and user interaction, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users with appropriate privileges and monitor for unusual activity related to shared storage access.