CVE-2026-35146 HCL DFXServer is affected by an Unencrypted Communication vulnerability.
Remote attackers can intercept sensitive data transmitted over unencrypted HTTP channels in HCL DFXServer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-35146?
CVE-2026-35146 is a medium-severity vulnerability in HCLSoftware DFXServer, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application.
Weakness: CWE-326
Which versions are affected by CVE-2026-35146?
It affects 1 product.
Products include Hcltech Dfx Server.
How do I fix CVE-2026-35146?
No fix has been published for CVE-2026-35146 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-35146 being exploited?
There is no known exploitation of CVE-2026-35146 in the wild and no public exploit code.
Other vulnerabilities in HCLSoftware DFXServer
- CVE-2026-35147 HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.
- CVE-2026-35149 HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation.
- CVE-2026-35148 HCL DFXServer is affected by a Missing Access Control vulnerability
Sources
Also known as GHSA-g8m2-fxgf-6pqg.