CVE-2026-35141 describes an authentication bypass vulnerability in HCL Software's DFXAnalytics product. The vulnerability is a login replay attack (CWE-294), where an attacker can capture valid authentication data and replay it later to bypass authentication controls. The lack of timestamping or message freshness validation allows intercepted authentication messages to be reused. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, user interaction required, and a scope change with no confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is provided, and the affected versions are not specified.

An attacker with the ability to intercept authentication messages and with high privileges and user interaction can replay valid authentication data to gain unauthorized access to the application. The impact is limited to low integrity loss without confidentiality or availability compromise. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor should implement timestamping or other freshness mechanisms in authentication messages to reject replayed messages that exceed a certain age threshold. Until an official fix is available, consider monitoring for replay attempts and restricting network access to trusted sources where feasible.