CVE Catalog
CVE-2026-56587
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk0.16%
5th percentile - higher than 5% of all known CVEs
Summary
HCL IEM does not enforce strict transport security (HSTS), allowing attackers to perform SSL stripping or man-in-the-middle attacks, compromising secure communications.
Risk Assessment
The risk is that attackers can intercept and modify network traffic, potentially leading to theft of credentials or other sensitive information.
Recommendation
It is recommended to enable and enforce the Strict-Transport-Security (HSTS) header on the server and redirect all HTTP traffic to HTTPS.
Original NVD description (English source)
HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications.