PatchTheCVEdfx server vulnerabilities and fixes
Recent CVEs affecting dfx server, with upgrade or downgrade steps. 4 tracked.
Also searched as: dfxserver.
dfx server has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-07-16. Highest priority: CVE-2026-35147 (score 43/100).
- CVE-2026-35147 HIGH 8.2 UPGRADE HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access
- CVE-2026-35149 HIGH 8.2 UPGRADE HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation
- CVE-2026-35148 MEDIUM 6.3 UPGRADE HCL DFXServer is affected by a Missing Access Control vulnerability
- CVE-2026-35146 MEDIUM 6.3 UPGRADE HCL DFXServer is affected by an Unencrypted Communication vulnerability
FAQ
How do I fix dfx server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is dfx server being exploited right now?
None of the tracked dfx server CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which dfx server CVE should I patch first?
CVE-2026-35147 currently ranks highest (43/100): HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.