CVE-2026-56584
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
HCL IEM was affected with an information disclosure issue in the nginx server, which may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.
Risk Assessment
The organization is at risk of information disclosure about software versions, which can help attackers launch targeted attacks against known vulnerabilities.
Recommendation
Configure the nginx server in HCL IEM to not disclose version information, for example by disabling the 'Server' header or hiding version details.
Other vulnerabilities in HCL IEM
See all- CVE-2026-56586Low
Missing X-Content-Type-Options header in HCL IEM allows attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.
- CVE-2026-56585Low
Missing Anti Clickjacking X-Frame-Options header in HCL IEM allows attackers to embed the application in malicious pages and induce unauthorized user actions.
- CVE-2026-56587Low
HCL IEM does not enforce strict transport security (HSTS), allowing attackers to perform SSL stripping or man-in-the-middle attacks, compromising secure communications.
Original NVD description (English source)
HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS