HCL DFXServer CVE-2026-35149

Exploitation requires the attacker to intercept and modify the server's authentication response messages exchanged with DFXServer - the specific precondition named in the description. This is feasible unauthenticated (PR:N) over the network (AV:N) with low complexity per the CVSS vector, but it presumes the attacker can observe and rewrite that response, either within their own client session (e.g., via a local intercepting proxy) or from an on-path position; if the deployment enforces properly validated end-to-end TLS and binds authentication to a server-verified secret, the response cannot be transparently altered, which limits exploitation. No user interaction is required (UI:N). Impact is confined to unauthorized access/confidentiality with only low integrity effect and no availability impact.

The signals are moderately consistent toward a real but not mass-exploitation priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack, and the impact is scoped to high confidentiality plus low integrity with no availability effect (C:H/I:L/A:N), consistent with gaining unauthorized read/access rather than full system compromise - which is why the score is 8.2 rather than critical. No EPSS score, no SSVC decision data, and no KEV entry were supplied, and no POC is referenced, so there is no evidence of active or automatable exploitation at this time. One caveat: the description's requirement to 'intercept and alter the server's authentication responses' can imply an on-path/MITM position, which would raise attack complexity beyond the AC:L the vendor assigned - if exploitation actually requires a privileged network position, real-world difficulty is higher than the vector suggests; verify the exact attack precondition with HCL.

An attacker with network access to DFXServer routes their client traffic through an intercepting proxy, submits a login attempt with no or invalid credentials, and rewrites the server's 'authentication failed' response into a 'success' response before the client processes it. Because the client trusts the response outcome, the attacker is admitted to the application and can read confidential data. No public exploit is identified at time of analysis, and the low-complexity network vector makes the technique straightforward for anyone able to manipulate the response stream.