The vulnerability in HCL AION causes certain user actions to fail to be audited or logged. This lack of proper logging means that the system cannot reliably track which users performed which actions, reducing accountability and hindering post‑incident investigations. According to the vendor description, the weakness is related to CWEs that concern logging and monitoring failures.

The affected product is HCL AION. No specific impacted versions are listed in the available data.

The CVSS score of 5.8 indicates a medium severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. While an attacker could use the missing logs to conceal malicious activity, the data does not indicate a direct exploitation path or elevated attack vector.