CVE-2026-35145
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
HCL DFXAnalytics is missing the HTTP Strict-Transport-Security (HSTS) header, allowing a remote attacker to downgrade the connection to unencrypted HTTP and perform man-in-the-middle (MitM) attacks.
Risk Assessment
The absence of HSTS exposes the organization to traffic interception and modification by an attacker, potentially leading to credential theft or other sensitive data compromise.
Recommendation
Configure the HCL DFXAnalytics application server to include the Strict-Transport-Security header in all HTTP responses.
Original NVD description (English source)
HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses.