CVE-2026-35140
LowCVSS 3.0Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
HCL DFXAnalytics fails to set the "secure" attribute on session cookies generated during authentication. This vulnerability allows a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.
Risk Assessment
The organization is at risk of session hijacking and credential theft, which could lead to unauthorized system access and exposure of confidential data.
Recommendation
Configure HCL DFXAnalytics to set the "secure" attribute on all session cookies and enforce the use of encrypted HTTPS connections for all traffic.
Original NVD description (English source)
HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.