CVE-2025-55261
Published: 26 March 2026
Summary
CVE-2025-55261 is a high-severity Improper Access Control (CWE-284) vulnerability in Hcltech Aftermarket Cloud. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-55261 is a Missing Functional Level Access Control vulnerability (CWE-284) affecting HCL Aftermarket DPC. Published on 2026-03-26 with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H), it enables an attacker to escalate privileges, potentially compromising the application and allowing unauthorized access to steal and manipulate data.
The vulnerability can be exploited by an unauthenticated attacker (PR:N) over the network (AV:N) with low attack complexity (AC:L), though it requires user interaction (UI:R). Successful exploitation grants high confidentiality impact (C:H) through data theft and high availability impact (A:H) via application compromise, with no direct integrity impact noted in the CVSS metrics despite the potential for data manipulation described.
For mitigation details, refer to the HCL Software advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209079
Vulnerability details
HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing functional-level access control directly enables remote exploitation for privilege escalation (T1068) on a public-facing web application (T1190), leading to unauthorized data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for functional level access, preventing privilege escalation and unauthorized data access in HCL Aftermarket DPC.
Implements least privilege to restrict access to only necessary functions, mitigating the impact of missing access controls and blocking escalation.
Manages accounts, roles, and privileges to ensure proper assignment and prevent conditions enabling privilege escalation via missing functional controls.