Login Request a demo
High severity · published Mar 26, 2026
CVE-2025-55275
HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability
8.1
CVSS
0.2%
EPSS
No
On KEV
Description
HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability using which an attacker can exploit concurrent sessions to hijack or impersonate an admin user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Aftermarket DPC · HCL
version 1.0.0 · source: vendor
AC
Aftermarket Cloud · Hcltech
1.0.0 · source: NVD
Affected product
AD
Aftermarket DPC
HCL
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-55275
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-55275
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793
More from Aftermarket DPC
9.8
CVE-2025-55261
HCL Aftermarket DPC is affected by Missing Functional Level Access Control
9.8
CVE-2025-55267
HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability
9.8
CVE-2025-55269
HCL Aftermarket DPC is affected by Weak Password Policy vulnerability
9.8
CVE-2025-55270
HCL Aftermarket DPC is affected by Improper Input Validation
8.8
CVE-2025-55271
HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability