CVE-2025-55265
Published: 26 March 2026
Summary
CVE-2025-55265 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Hcltech Aftermarket Cloud. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 3.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2025-55265 is a file discovery vulnerability (CWE-200) affecting HCL Aftermarket DPC software. Published on 2026-03-26, it has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The flaw enables an attacker to read sensitive files on the system, potentially using the disclosed information to facilitate further attacks.
A remote attacker with no privileges can exploit this vulnerability over the network with low complexity, though it requires user interaction, such as tricking a user into performing an action like clicking a malicious link. Successful exploitation grants high confidentiality impact by exposing sensitive files, but does not allow integrity or availability disruption.
The HCL advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 provides details on mitigation and patches for this issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209053
Vulnerability details
HCL Aftermarket DPC is affected by File Discovery which allows attacker could exploit this issue to read sensitive files present in the system and may use it to craft further attacks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthorized read access to sensitive local files matches T1005 Data from Local System.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the file discovery vulnerability (CVE-2025-55265) in HCL Aftermarket DPC by identifying, reporting, and correcting the flaw through patching as advised by HCL.
Filters information outputs to prevent disclosure of sensitive files that can be accessed via the file discovery exploitation.
Monitors the system for unauthorized disclosures of sensitive information, detecting exploitation attempts or successes of the file discovery vulnerability.