CVE-2026-35143: hcl software dfxanalytics
Vulnerability summary
CVE-2026-35143 is a medium (CVSS 6.5) vulnerability in hcl software dfxanalytics. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.8% of scored vulnerabilities.
Timeline
- 16-07-2026PublishedVulnerability first disclosed.
- 16-07-2026Last modifiedVulnerability information updated.
Description
HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA3.0LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
0.00 pp
From 0.16% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected systems
Hcl software1 product
- dfxanalyticsversion 3.0 and below
Hcltech1 product
- dfxanalytics≤ 3.0
2 vendors · 2 products