CVE-2026-56587
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
HCL IEM does not enforce strict transport security (HSTS), allowing attackers to perform SSL stripping or man-in-the-middle attacks, compromising secure communications.
Risk Assessment
The risk is that attackers can intercept and modify network traffic, potentially leading to theft of credentials or other sensitive information.
Recommendation
It is recommended to enable and enforce the Strict-Transport-Security (HSTS) header on the server and redirect all HTTP traffic to HTTPS.
Other vulnerabilities in HCL IEM
See all- CVE-2026-56586Low
Missing X-Content-Type-Options header in HCL IEM allows attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.
- CVE-2026-56585Low
Missing Anti Clickjacking X-Frame-Options header in HCL IEM allows attackers to embed the application in malicious pages and induce unauthorized user actions.
- CVE-2026-56584Low
HCL IEM was affected with an information disclosure issue in the nginx server, which may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.
Original NVD description (English source)
HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS