Medium severity · published Jul 16, 2026
CVE-2026-35148
HCL DFXServer is affected by a Missing Access Control vulnerability
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
DFXServer · HCL Software
version 2.5 and below · source: vendor
DS
Dfx Server · Hcltech
through 2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35148
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35148
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782
More from DFXServer
8.2
CVE-2026-35147
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.
8.2
CVE-2026-35149
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.