The vulnerability arises from auto‑complete functionality that is enabled for certain input fields within HCL AION. This behavior can cause sensitive information to be stored in the browser’s auto‑complete cache, which may be exposed to unintended users or processes if the data is later retrieved from the browser. The weakness is classified as CWE‑201, indicating an improper storage of confidential information within a device that could be read or copied by unauthorized parties. The overall impact is the potential disclosure of sensitive data, rather than code execution or denial of service.

AION, a product of HCL software. No specific version information is provided, so the vulnerability may affect all releases until the vendor issues a patch or configuration fix. Users of HCL AION should consult the vendor’s advisory for exact version applicability.

The CVSS score of 2.6 places this issue in the low severity range. EPSS data is not available, so the probability of exploitation cannot be quantified, and the vulnerability has not been reported in the CISA KEV catalog. The likely attack vector involves a local or user‑level context: an authenticated user interacting with the application may cause data to be cached in their browser and subsequently accessed by other users or processes on the same machine. Even with low probability, the risk of leaking sensitive information warrants prompt remediation.