CVE-2026-35148 describes an improper access control vulnerability in HCL Software's DFXServer product. The issue allows unauthenticated network users to access certain API endpoints without any authentication or authorization checks. This missing access control flaw could lead to unauthorized interactions with the application, potentially impacting confidentiality, integrity, and availability to a limited extent as reflected by the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). No vendor advisory or patch information is currently available to confirm remediation status or affected versions.

An attacker on the network can invoke vulnerable API endpoints without authentication, potentially leading to limited unauthorized disclosure, modification, or disruption of application data or functionality. The impact is rated medium severity with partial confidentiality, integrity, and availability impacts. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected DFXServer endpoints where possible and monitor for unauthorized access attempts. Avoid exposing these endpoints to untrusted networks.