CVE-2026-35145
Received Received - Intake

Missing HSTS Header in HCL DFXAnalytics

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: HCL Software

Description
HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-35145
EUVD
EUVD-2026-44920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcl dfxanalytics *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HCL DFXAnalytics has a Missing HTTP Strict-Transport-Security Header vulnerability. This means the application does not enforce HTTPS by default through the HSTS policy. Attackers could exploit this to downgrade connections to unencrypted HTTP and intercept or manipulate data via man-in-the-middle attacks.

Detection Guidance

To detect the missing HTTP Strict-Transport-Security header in HCL DFXAnalytics, use tools like curl to check HTTP responses. Run: curl -I http://your-server-address. If the response lacks the 'Strict-Transport-Security' header, the vulnerability exists.

Impact Analysis

This vulnerability allows attackers to intercept unencrypted communications, potentially stealing sensitive data or altering it during transmission. Users may face data breaches, unauthorized access, or loss of data integrity without realizing their connection was compromised.

Compliance Impact

This vulnerability likely violates requirements for encrypted data transmission in GDPR and HIPAA. Both regulations mandate strong security measures to protect personal and health data. Failure to implement HSTS could result in non-compliance, legal penalties, or loss of certification.

Mitigation Strategies

Immediately configure the application to include the 'Strict-Transport-Security' header in all web responses. Ensure HTTPS is enforced and the header is set with appropriate directives like 'max-age=31536000; includeSubDomains'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart