CVE-2025-52660: HCL Software AION · Improper Neutralization of HTTP Headers for Scripting Syntax
Affects HCL Software AIONSource CVE Database V5
Not known to be exploited · CVSS 2.7 Low.
Data as of 26 Oct 2026, 11:07 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 19 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| HCL SoftwareAION | Affected
| Fixed in– |
AI-suggested
To mitigate CVE-2025-52660, European organizations should implement strict access control policies to limit the number of users with high privileges capable of uploading files to HCL AION. Employ application-layer filtering and validation to detect and block unauthorized or suspicious file uploads. Monitor logs and file upload activity for anomalies indicative of exploitation attempts. Segregate the AION environment from critical systems to contain potential compromises. Apply network segmentation and use intrusion detection/prevention systems to detect malicious payloads. Engage with HCL Software to obtain patches or updates as soon as they become available and prioritize their deployment. Additionally, conduct regular security audits and penetration testing focused on file upload functionalities to identify and remediate weaknesses proactively.
Description
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.