HCL DFXAnalytics Login authentication replay

Summaryinfo

A vulnerability identified as critical has been detected in HCL DFXAnalytics. Affected is an unknown function of the component Login. Performing a manipulation results in authentication replay. This vulnerability is identified as CVE-2026-35141. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in HCL DFXAnalytics (affected version not known). This affects some unknown functionality of the component Login. The manipulation with an unknown input leads to a authentication replay vulnerability. CWE is classifying the issue as CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must implement a mechanism to include timestamps with every message, ensuring that messages exceeding a specific age threshold are automatically rejected by the recipient system.

The advisory is shared at support.hcl-software.com. This vulnerability is uniquely identified as CVE-2026-35141 since 04/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/16/2026). MITRE ATT&CK project uses the attack technique T1040 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-44917). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• HCL

Name

• DFXAnalytics

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion