HCL IntelliOps IEM CVE-2026-56584

The IEM nginx web interface must be reachable over the network by the attacker - the vulnerability is network-accessible per AV:N. The vendor-supplied CVSS vector assigns AC:H, suggesting version information may only be exposed under specific conditions (e.g., triggering nginx error responses via malformed or unexpected requests, rather than being present on every HTTP response). No authentication is required per PR:N. Exploitation is limited to information gathering: the attacker learns the nginx version but gains no direct access, code execution, or data. The primary limiting factor is whether version disclosure is restricted to error-triggering request patterns (AC:H) rather than universally present. Deployments that already apply 'server_tokens off' in nginx configuration are not affected. The vulnerability does not apply to deployments where the IEM interface is not network-exposed.

The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a low-severity, information-disclosure-only finding. The AC:H designation in the vendor-supplied vector is notable: for a straightforward HTTP header read, one would typically expect AC:L; the high complexity may indicate that version information is only exposed under specific error conditions or non-default request patterns rather than in every response. No EPSS score was provided in the input data, and neither a KEV listing nor public exploit code (POC) was identified. The practical risk is indirect - this vulnerability alone causes no data breach, service disruption, or code execution - but it lowers the effort bar for reconnaissance when combined with an outdated, vulnerable nginx version. The real priority depends on whether the underlying nginx version is patched: if it is current, this CVE's residual risk is negligible. The vendor-assigned AC:H versus the typically AC:L nature of header disclosure is a discrepancy that warrants verification against the vendor advisory.

An attacker sends a crafted HTTP request - such as a request for a non-existent resource to trigger an nginx error page, or simply inspecting the Server response header on any IEM endpoint - to retrieve the nginx version string. The attacker then queries public CVE databases for vulnerabilities matching that exact version and, if an unpatched nginx version is identified, proceeds to exploit a known nginx flaw against the same host. No public exploit code for this specific CVE (CVE-2026-56584) has been identified at time of analysis.