CVE-2026-35149 describes an authentication bypass vulnerability in HCL DFXServer. The flaw allows an attacker to manipulate intercepted server authentication responses to bypass verification and gain unauthorized access. This is a network attack vector with low attack complexity and no privileges or user interaction required. The impact includes high confidentiality impact and low integrity impact, with no availability impact. The vulnerability is categorized as CWE-294 (Authentication Bypass). No official remediation or patch information is provided in the available data.

An attacker can gain unauthorized access to the HCL DFXServer application without valid credentials by manipulating server authentication responses. This compromises confidentiality by exposing potentially sensitive data. Integrity impact is low, and availability is not affected. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor HCL Software advisories for updates. Until a fix is available, consider restricting network access to the DFXServer and employing network-level protections to prevent interception and manipulation of authentication traffic.