CVE-2026-56586
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Missing X-Content-Type-Options header in HCL IEM allows attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.
Risk Assessment
The risk involves potential data interception via man-in-the-middle attacks.
Recommendation
Configure the X-Content-Type-Options header and update HCL IEM.
Other vulnerabilities in HCL IEM
See all- CVE-2026-56585Low
Missing Anti Clickjacking X-Frame-Options header in HCL IEM allows attackers to embed the application in malicious pages and induce unauthorized user actions.
- CVE-2026-56587Low
HCL IEM does not enforce strict transport security (HSTS), allowing attackers to perform SSL stripping or man-in-the-middle attacks, compromising secure communications.
- CVE-2026-56584Low
HCL IEM was affected with an information disclosure issue in the nginx server, which may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.
Original NVD description (English source)
HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS