HCL DFXAnalytics CVE-2026-35142

The application must be network-reachable by the attacker and must generate server responses that embed internal IP address details - the vulnerability manifests in DFXAnalytics 3.0 and below by design of its response handling, so no special feature toggle or non-default configuration is stated as required. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation needs no authentication and no user interaction. The primary limiting factors are that impact is confined to information disclosure of network topology (no code execution, no data modification, no service impact), the leaked data has value only as reconnaissance feeding a further attack, and exposure is reduced when the instance is restricted to internal/trusted networks rather than internet-facing.

The signals conflict on severity and should be weighed carefully. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:L/A:N = 8.2 High) rates confidentiality impact as High, which is aggressive for a vulnerability that only discloses internal IP addresses - network topology metadata is reconnaissance value, not bulk sensitive data, so a Low confidentiality impact (assessed ~5.3) is more defensible; verify the C:H rating with HCL. Countervailing lower-risk signals dominate the real-world picture: EPSS is 0.16% (6th percentile), CISA SSVC lists Exploitation as none, Automatable as no, and Technical Impact as only partial, and no public exploit code has been identified. Net assessment: this is a genuine but low-priority information-disclosure finding - useful to an attacker as a stepping stone in a larger chain, not a standalone critical issue. The high raw CVSS overstates urgency relative to exploitation probability and technical impact.

A remote attacker with no credentials sends normal HTTP requests to an internet-reachable DFXAnalytics instance and inspects the responses, harvesting internal IP addresses and hostnames leaked in headers, error output, or body content. The attacker uses this map of internal addressing to plan lateral movement and target specific backend systems in a later phase. No public proof-of-concept is required given the low complexity (AC:L) and lack of authentication (PR:N).