Is CVE-2025-62319 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-62319 being exploited in the wild.

How severe is CVE-2025-62319?

Critical severity, with a CVSS score of 9.8, published 16 March 2026.

Which products and versions are affected?

HCL Software Unica up to (excluding) 25.1.1.0.1; HCL Software Unica Audience Central up to (excluding) 25.1.1.0.1; HCL Software AION.

Is there a fix for CVE-2025-62319?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-62319 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-62319?

Check whether you run Hcltech Unica or Hcltech Unica Audience Central. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-62319: HCL Unica blind SQL injection in backend configuration queries

CVE-2025-62319 · Severity: critical · CVSS 9.8 · Published 2026-03-16

HCL Unica and AION, platforms used for enterprise marketing automation and customer engagement, are affected by a critical security flaw. An attacker can use specially crafted inputs to trick the system's database into revealing sensitive information or modifying configuration data. This could lead to a total compromise of the marketing platform, including the theft of customer data or disruption of business operations.

Technologies: Hcltech Unica. Vendors: Hcltech.

Quick answers

Is CVE-2025-62319 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-62319 being exploited in the wild.
How severe is CVE-2025-62319?: Critical severity, with a CVSS score of 9.8, published 16 March 2026.
Which products and versions are affected?: HCL Software Unica up to (excluding) 25.1.1.0.1; HCL Software Unica Audience Central up to (excluding) 25.1.1.0.1; HCL Software AION.
Is there a fix for CVE-2025-62319?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-62319 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-62319?: Check whether you run Hcltech Unica or Hcltech Unica Audience Central. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A boolean-based blind SQL injection vulnerability exists in HCL Unica and Unica Audience Central (and related AION components) due to improper neutralization of special elements in SQL commands (CWE-89). The flaw resides in application input fields used for backend configuration queries. An unauthenticated attacker can send malicious network requests containing Boolean conditions (TRUE/FALSE) to infer data from the database based on the application's response patterns. This can lead to full unauthorized access to sensitive data, integrity loss of the database, and potential service unavailability. The issue is addressed in version 25.1.1.0.1.

Affected products

HCL Software Unica up to (excluding) 25.1.1.0.1
HCL Software Unica Audience Central up to (excluding) 25.1.1.0.1
HCL Software AION

Timeline

2026-03-16: disclosed
2026-03-16: advisory

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.