CVE-2026-35141: hcl software dfxanalytics Authentication Bypass by Capture-replay

Vulnerability summary

CVE-2026-35141 is a medium (CVSS 5.3) Authentication Bypass by Capture-replay vulnerability in hcl software dfxanalytics. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.7% of scored vulnerabilities.

Timeline

1. 16-07-2026
   PublishedVulnerability first disclosed.
2. 16-07-2026
   Last modifiedVulnerability information updated.

Description

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must implement a mechanism to include timestamps with every message, ensuring that messages exceeding a specific age threshold are automatically rejected by the recipient system.

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).