CVE-2026-35149: hcl software dfxserver Authentication Bypass by Capture-replay

Vulnerability summary

CVE-2026-35149 is a high (CVSS 8.2) Authentication Bypass by Capture-replay vulnerability in hcl software dfxserver. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.5% of scored vulnerabilities.

Timeline

1. 16-07-2026
   PublishedVulnerability first disclosed.
2. 16-07-2026
   Last modifiedVulnerability information updated.

Description

HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).