CVE-2026-35147

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:dfx_server:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) HCL DFXServer está afectado por una vulnerabilidad de autenticación rota a través de acceso directo a la API. La aplicación no verifica el estado de autenticación del usuario al acceder a puntos finales específicos de la API, permitiendo a un atacante no autenticado interactuar con las API y realizar acciones no autorizadas sin credenciales válidas.

Information

Published : 2026-07-16 12:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-35147

Mitre link : CVE-2026-35147

CVE.ORG link : CVE-2026-35147

JSON object : View

Products Affected

hcltech

dfx_server

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-35147", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35147", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T11:53:13.346076Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "DFXServer", "versions": [{"status": "affected", "version": "version 2.5 and below"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-16T12:17:35.617", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials."}, {"lang": "es", "value": "HCL DFXServer est\u00e1 afectado por una vulnerabilidad de autenticaci\u00f3n rota a trav\u00e9s de acceso directo a la API. La aplicaci\u00f3n no verifica el estado de autenticaci\u00f3n del usuario al acceder a puntos finales espec\u00edficos de la API, permitiendo a un atacante no autenticado interactuar con las API y realizar acciones no autorizadas sin credenciales v\u00e1lidas."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:dfx_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E55827A6-D50C-408A-B019-1F028F90A778", "versionEndIncluding": "2.5"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}