CVE-2026-56453: dfxanalytics through 3.0 (inclusive); +1 more affected products

Affected technology

dfxanalytics · through 3.0 (inclusive)
hcltech

DFXAnalytics · version 3.0 and below
HCL Software

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts. Vendor/CNA’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality, integrity and availability impact as low. NVD’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.