CVE-2025-52628: Hcltech Aion

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.

Affected products

• Hcltech Aion: version 2.0.0 only

Published 2026-02-03. Last modified 2026-06-17.