CVE-2026-35149

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:dfx_server:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) HCL DFXServer está afectado por una vulnerabilidad de omisión de autenticación mediante manipulación de la respuesta del servidor. Un usuario no autorizado sin credenciales válidas puede explotar esta falla interceptando y alterando las respuestas de autenticación del servidor, permitiéndoles obtener acceso no autorizado a la aplicación sin verificación.

Information

Published : 2026-07-16 12:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-35149

Mitre link : CVE-2026-35149

CVE.ORG link : CVE-2026-35149

JSON object : View

Products Affected

hcltech

dfx_server

CWE

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2026-35149", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35149", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T12:06:27.976772Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "DFXServer", "versions": [{"status": "affected", "version": "version 2.5 and below"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-16T12:17:35.870", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification."}, {"lang": "es", "value": "HCL DFXServer est\u00e1 afectado por una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n mediante manipulaci\u00f3n de la respuesta del servidor. Un usuario no autorizado sin credenciales v\u00e1lidas puede explotar esta falla interceptando y alterando las respuestas de autenticaci\u00f3n del servidor, permiti\u00e9ndoles obtener acceso no autorizado a la aplicaci\u00f3n sin verificaci\u00f3n."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:dfx_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E55827A6-D50C-408A-B019-1F028F90A778", "versionEndIncluding": "2.5"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}