Account Lockout Bypass Vulnerability in HCL AION Software

CVE-2026-66987

What is CVE-2026-66987?

HCL AION is susceptible to an issue where its account lockout mechanism fails to adequately limit the number of failed login attempts. This flaw allows attackers to exploit the system with repeated password guesses against target user accounts, significantly increasing the likelihood of account takeovers via brute-force methods. The compromised accounts could lead to unauthorized access, resulting in potential adverse impacts on user data and system functionality.

References