High severity · published Jul 16, 2026
CVE-2026-35147
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
DFXServer · HCL Software
version 2.5 and below · source: vendor
DS
Dfx Server · Hcltech
through 2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35147
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35147
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782
More from DFXServer
8.2
CVE-2026-35149
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.
6.3
CVE-2026-35148
HCL DFXServer is affected by a Missing Access Control vulnerability