Quick answers
- Is CVE-2025-52657 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-52657 being exploited in the wild.
- How severe is CVE-2025-52657?
- Low severity, with a CVSS score of 3.5, published 7 September 2026.
- Which products and versions are affected?
- HCL MyXalytics.
- Is there a fix for CVE-2025-52657?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-52657 attacked?
- It is attacked over the network.
- Am I affected by CVE-2025-52657?
- Check whether you run HCL MyXalytics. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in HCL MyXalytics' input handling mechanism, which lacks validation on the number of characters users can submit. This insufficient input validation enables a denial-of-service (DoS) attack where an attacker can send excessively large payloads to consume system resources such as memory, CPU, or disk space. The attack vector is network-based and requires no authentication or special privileges. By submitting large amounts of data repeatedly, an attacker can degrade system performance or cause the application to become unresponsive. The vulnerability has been assigned CVE-2025-52657 with a CVSS score of 3.5.
Affected products
- HCL MyXalytics
Timeline
- 2026-09-07: disclosed