What is the CVSS score of CVE-2026-35142?

CVE-2026-35142 has a contested CVSS base score of 8.2 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of HCL DFXAnalytics are affected by CVE-2026-35142?

HCL DFXAnalytics versions 3.0 and below leak internal IP addresses through unauthenticated server responses, enabling remote attackers to enumerate your internal network topology for reconnaissance.

How to fix or mitigate CVE-2026-35142?

Within 24 hours: Identify and document all systems running HCL DFXAnalytics version 3.0 or below, then implement network-layer access controls restricting DFXAnalytics connectivity to authorized internal networks only. Within 7 days: Deploy monitoring for reconnaissance patterns targeting DFXAnalytics endpoints and consider web application firewall rules to detect enumeration attempts. Within 30 days: Contact HCL for remediation guidance including patch availability or version upgrade options; if no vendor fix emerges, evaluate product replacement and implement permanent compensating controls such as network segmentation and request inspection.

HCL DFXAnalytics CVE-2026-35142

EUVD-2026-44918 HIGH

Information Exposure (CWE-200)

2026-07-16 HCL

GHSA-xxvx-4jh7-w294

Information Disclosure Dfxanalytics Hcl Software

High

Disputed · 8.2 NVD

Severity by source

Sources disagree (Low–High)

Vendor (HCL) PRIMARY

LOW

qualitative

NVD

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

5.3 MEDIUM

Remote unauthenticated with no interaction (AV:N/AC:L/PR:N/UI:N), but disclosure of internal IPs is limited reconnaissance data so C:L not C:H, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 17, 2026 - 16:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 17, 2026 - 16:37 vuln.today

cvss_changed

Severity Changed

Jul 17, 2026 - 16:37 NVD

LOW HIGH

CVSS changed

Jul 17, 2026 - 16:37 NVD

2.6 (LOW) 8.2 (HIGH)

Analysis Generated

Jul 16, 2026 - 13:46 vuln.today

DescriptionNVD

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.

AnalysisAI

Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedded within the application's server responses, allowing a remote unauthenticated attacker to enumerate internal infrastructure for reconnaissance. The issue was reported by HCL and carries a vendor CVSS of 8.2, though it maps to a CWE-200 information exposure with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and CISA SSVC rates exploitation as none and non-automatable.

Technical ContextAI

DFXAnalytics is an HCL Software analytics application (CPE cpe:2.3:a:hcl_software:dfxanalytics). The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the application leaks internal/private IP address details inside HTTP server responses rather than stripping or masking them. Such leakage typically originates from verbose error pages, response headers, redirect Location fields, embedded metadata, or backend hostnames/addresses reflected to the client. The disclosed data does not grant access itself but reveals the structure of the internal network (RFC 1918 addressing, host segmentation, backend service placement), which is valuable input for subsequent targeted attacks.

RemediationAI

Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787 and upgrade DFXAnalytics beyond version 3.0 to the vendor-fixed release - patch available per vendor advisory, though an exact fixed version number is not stated in the available data and should be confirmed with HCL. As compensating controls until patched: place DFXAnalytics behind a reverse proxy or WAF configured to rewrite/strip internal IP addresses and private-range values from response bodies, headers, and Location redirects; disable verbose error pages and debug output that echo backend host details; and restrict direct network exposure of the application to trusted management networks. The trade-off of proxy-based response rewriting is possible breakage of legitimate responses that embed addressing, so test filtering rules before enforcing them.