CVE-2025-59851 describes HCL DFXAnalytics shipping unpatched libraries or sub components with publicly known vulnerabilities, scored CVSS 3.7 (low). The fix is a vendor update, and HCL's knowledge base article names the build. Confirm it and also inventory what your own software bundles.
What's affected
The NVD record names HCL DFXAnalytics and lists no CWE and no version ranges. The wording is generic: the application uses unpatched libraries. A second record from the same article, CVE-2025-59852, covers unencrypted transport.
The HCL support portal did not return article text when I fetched it, so this guide relies on the NVD record. Read the article itself for the fixed version.
How to check if you're exposed
HCL publishes the affected and fixed builds for DFXAnalytics in its knowledge base article, and that article is the authority. I could not read its text when preparing this guide, so I will not state a fixed version here.
- Find the build you run. The admin or about page of the product usually shows it, and so does your deployment record.
- Open the HCL article listed under Sources and compare your build with its list of affected and fixed builds.
- If the article lists a fix and you are behind it, you are exposed to the issue described here. If your build is not named, ask HCL support to confirm in writing.
If you can obtain a software bill of materials from the vendor, compare it with the Gold directory and the free scan. Otherwise, ask HCL which libraries were updated in the fixed build.
What to do now
- Find every DFXAnalytics deployment and its build.
- Apply the build named in the HCL article.
- Ask HCL for a component list, or generate your own inventory of what the installation contains.
- Run the free in-browser dependency scan on any dependency manifests you control, to see known issues in your own components.
- Patch CVE-2025-59852 in the same change.
Why it matters
This record has no CWE because it is a category, not a single coding error. It reflects a common supply chain problem: a product bundles third party libraries, and those libraries age while the product's own code stays the same.
The score is low because the record names no specific library or exploit path. The lesson is practical. You can only act on component risk if you know what is inside your software, and an inventory is the first step. Reachability analysis then helps rank which findings are actually used.
Quick check
Which libraries are the problem?
The record does not say. Ask the vendor or generate an inventory of the installation to find out.
Sources
Last reviewed: 19 October 2026.
