Information disclosure in Hcl Software Dfxanalytics
CVE-2026-35145
HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses.
Vulnerability class: Information Disclosure
EPSS: 0.003 (19.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Hcl Software Dfxanalytics — versions version 3.0 and below
- Hcltech Dfxanalytics
Weakness classification (CWE)
References
- psirt@hcl.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-35145?
- CVE-2026-35145 is a low-severity vulnerability in Hcl Software Dfxanalytics, classified under Information Disclosure. CVSS score: 3.1/10. Published 2026-07-16.
- How severe is CVE-2026-35145?
- Low severity. CVSS v3 base score is 3.1 out of 10.