HCL IntelliOps IEM CVE-2025-62306

Exploitation requires an authenticated session with at least low-privilege access to the HCL IEM application, per the CVSS vector PR:L. The application is network-accessible (AV:N), so the condition is reachable remotely by any valid account holder without physical or local access. No special non-default configuration is described as a prerequisite - the logging omission appears to be a default application behavior. Exploitation is bounded to users who have already acquired valid credentials; unauthenticated attackers cannot trigger the missing-log condition without first authenticating. The vulnerability does not by itself grant elevated access, enable data exfiltration, or cause service disruption - its impact is limited to reducing the fidelity of the audit trail, which benefits an adversary already operating within the application.

With a CVSS 5.0 medium score, no CISA KEV listing, and no known public exploit, this vulnerability does not represent an active exploitation threat at the time of analysis. The vector AV:N/AC:L/PR:L indicates the condition is reachable by any authenticated low-privilege user over the network - a realistic post-compromise scenario requiring no special technical sophistication. EPSS data is not present in the provided intelligence, so probability-of-exploitation estimates cannot be independently assessed. The Scope:Changed component is the most consequential aspect: organizations relying on IEM as a data source for centralized SIEM or compliance auditing will experience downstream data completeness failures, not just an application-level gap. The real-world priority is compliance-driven - entities subject to SOC 2, ISO 27001, PCI-DSS, or HIPAA audit requirements must treat incomplete logging as a documented control failure regardless of active exploitation status. This is not a high-urgency patching priority for most security teams, but it carries material risk for regulated environments where audit trail completeness is a contractual or regulatory obligation.

An attacker who has obtained low-privilege IEM credentials - through credential stuffing, phishing, or lateral movement from a compromised endpoint - manipulates event workflows or accesses sensitive operational data within IEM. Because the application omits audit records for these actions, the security operations team conducting post-incident forensics finds no trace of the attacker's activity within IEM logs, delaying attribution, containment scoping, and any regulatory breach notification obligations. No public exploit code exists for this vulnerability.