CVE-2025-52640 HCL AION is affected by multiple security vulnerabilities.
Insufficient access separation in shared storage allows processes to access or modify files beyond their intended scope.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-52640?
CVE-2025-52640 is a medium-severity missing authorization vulnerability in HCL Software AION, published on 13 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions.
Weakness: CWE-276
Which versions are affected by CVE-2025-52640?
How do I fix CVE-2025-52640?
No fix has been published for CVE-2025-52640 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-52640 being exploited?
There is no known exploitation of CVE-2025-52640 in the wild and no public exploit code.
Sources
Also known as GHSA-cg9m-h438-9c8x.