CVE-2026-35140 HCL Software CVE debrief

Who should care

Users of HCL DFXAnalytics, particularly those responsible for configuration and security, should review their configurations to ensure secure attributes are properly set for session cookies. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the potential impact and implement necessary mitigations.

Technical summary

The HCL DFXAnalytics application fails to set the 'secure' attribute on session cookies generated during authentication. This vulnerability could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels. The CVSS score of 3 indicates a low severity, but users should review and update configurations to ensure secure attributes are set for session cookies. Implementing additional security measures such as encryption and secure authentication protocols is also recommended.

Defensive priority

Low priority given the CVSS score of 3 and the requirement for specific conditions to be met for exploitation. However, users should still review and update configurations to ensure secure attributes are set for session cookies and implement additional security measures.

Recommended defensive actions

• Review and update configurations to ensure secure attributes are set for session cookies
• Monitor for and restrict unauthorized access to sensitive data
• Implement additional security measures such as encryption and secure authentication protocols
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and verification are necessary to fully understand the scope and impact of the vulnerability. Affected product deployments need to be reviewed for potential exposure, and defenders should verify configurations to ensure secure attributes are set for session cookies. Evidence limits suggest additional review is required to confirm affected scope and severity.

Official resources