Medium severity · published Jul 16, 2026
CVE-2026-35146
HCL DFXServer is affected by an Unencrypted Communication vulnerability.
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
DFXServer · HCLSoftware
version 2.5 and below · source: vendor
DS
Dfx Server · Hcltech
through 2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35146
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782
More from DFXServer
3.3
CVE-2025-59866
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in…