CVE-2026-35148
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
63/100
Published: 2026-07-16
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Unchanged
C:
Low
I:
Low
A:
Low
Description
HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| hcltech | dfx_server | < 2.5 |
References & Advisories (1)
Vendor Advisory