What is the CVSS score of EUVD-2026-44908?

EUVD-2026-44908 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Dfxserver are affected by EUVD-2026-44908?

HCL DFXServer contains an authentication bypass vulnerability (CVE-2026-35147) allowing unauthenticated remote attackers to access sensitive API endpoints and retrieve confidential data.

How to fix or mitigate EUVD-2026-44908?

Within 24 hours, identify and inventory all HCL DFXServer instances in your environment and document their network exposure and connected data classification. Within 7 days, restrict network access to DFXServer API endpoints via firewall rules or VPN segmentation, deploy Web Application Firewall rules to monitor and block suspicious API traffic, and enable comprehensive audit logging on all instances. Within 30 days, establish communication with HCL support to confirm patch release timeline, evaluate feasibility of upgrading to a patched version when available, and assess whether alternative products should replace DFXServer to mitigate ongoing risk.

Dfxserver EUVD-2026-44908

| CVE-2026-35147 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-16 HCL

GHSA-36pf-7582-rqcr

Authentication Bypass Dfxserver Hcl Software

8.2

CVSS 3.1 · Vendor: HCL

Severity by source

Vendor (HCL) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from Vendor (HCL) · only source for this CVE.

CVSS VectorVendor: HCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 12:05 vuln.today

CVE Published

Jul 16, 2026 - 11:04 cve.org

HIGH 8.2

DescriptionCVE.org

HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.

AnalysisAI

Authentication bypass in HCL DFXServer allows remote unauthenticated attackers to reach specific API endpoints directly and perform unauthorized actions without valid credentials, because the application never verifies authentication status on those routes. The primary impact is high confidentiality exposure with limited integrity impact (CVSS 8.2), and the flaw was self-reported by HCL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.