CVE-2026-35146
Received Received - Intake

Unencrypted Communication in HCL DFXServer

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: HCL Software

Description
HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-35146
EUVD
EUVD-2026-44905

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcl dfxserver *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HCL DFXServer has an Unencrypted Communication vulnerability. It allows users to connect via HTTP, which is unencrypted. This could let a remote attacker intercept network traffic and expose sensitive data sent between the user and the application.

Detection Guidance

To detect unencrypted HTTP traffic from HCL DFXServer, monitor network traffic for HTTP connections to DFXServer ports. Use tools like Wireshark or tcpdump to capture and inspect packets for unencrypted data transmission. Check server logs for HTTP requests instead of HTTPS.

Impact Analysis

This vulnerability could allow attackers to intercept sensitive data like login credentials or personal information transmitted between you and the application. It may also enable attackers to manipulate data or perform unauthorized actions if they gain access to exposed information.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA, which mandate encryption for data in transit. Failure to encrypt communications could result in data breaches, leading to legal penalties, fines, or regulatory actions against the organization using the affected software.

Mitigation Strategies

Disable HTTP access and enforce HTTPS in DFXServer configuration. Update to the latest patched version if available. Configure firewalls to block unencrypted traffic to DFXServer ports. Monitor for suspicious network activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart