Medium severity · published Aug 13, 2026
CVE-2026-21832
HCL AION is affected by multiple security vulnerabilities.
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
AION · HCL Software
v2.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-21832
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-21832
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133084
More from AION
9.8
CVE-2025-55252
HCL AION is affected by a Weak Password Policy vulnerability
9.8
CVE-2025-52660
HCL AION is affected by an Host Header Injection vulnerability
9.8
CVE-2025-55251
HCL AION is affected by an Unrestricted File Upload vulnerability
7.5
CVE-2025-52659
HCL AION is affected by a Cacheable HTTP Response vulnerability
5.6
CVE-2025-62314
HCL AION is affected by multiple security vulnerabilities.