What is the CVSS score of CVE-2026-56585?

CVE-2026-56585 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

IntelliOps Event Management CVE-2026-56585

EUVD-2026-46277 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-07-21 HCL

GHSA-rmmj-ff6h-8758

Authentication Bypass Intelliops Event Management

4.3

CVSS 3.1 · NVD

Severity by source

Vendor (HCL) PRIMARY

LOW

qualitative

NVD

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Framing an application in an iframe requires no special conditions beyond the missing header, so AC:L; victim interaction is mandatory (UI:R); no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 30, 2026 - 13:22 NVD

LOW MEDIUM

CVSS changed

Jul 30, 2026 - 13:22 NVD

3.1 (LOW) 4.3 (MEDIUM)

Analysis Generated

Jul 21, 2026 - 15:47 vuln.today

DescriptionNVD

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions.

AnalysisAI

Clickjacking exposure in HCL IntelliOps Event Management (IEM) allows network-based attackers to embed the application inside a malicious webpage via an iframe and deceive authenticated users into performing unintended administrative or operational actions. All tracked versions under the CPE wildcard are affected, per HCL advisory KB0132378. No public exploit identified at time of analysis, and the CVSS score of 3.1 (Low) reflects the non-trivial attack complexity and limited integrity-only impact.

Technical ContextAI

The vulnerability maps to CWE-693 (Protection Mechanism Failure), specifically the absence of the X-Frame-Options HTTP response header (or an equivalent Content-Security-Policy frame-ancestors directive). Without this header, modern browsers permit any third-party origin to load the IEM application inside an iframe element. The CPE string cpe:2.3:a:hclsoftware:intelliops_event_management:*:*:*:*:*:*:*:* indicates the wildcard version range, implying all released versions of HCL IntelliOps Event Management are affected. IEM is an enterprise IT operations and event management platform; its web UI is the attack surface here. The root cause is a missing defensive HTTP header rather than a logic flaw in application code.

RemediationAI

Apply the patch or configuration change recommended in HCL advisory KB0132378 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132378 - an exact fixed version number is not specified in the available input data, so consult the advisory directly for the precise release. As a compensating control pending patching, configure the IEM web server or application layer to emit the X-Frame-Options: DENY header on all responses, which instructs browsers to refuse framing from any origin; alternatively, use Content-Security-Policy: frame-ancestors 'none' for modern browsers. Restricting IEM access to trusted internal networks or VPN also reduces the attacker's ability to deliver a convincing phishing page to targeted users, though it does not eliminate the header absence. Note that server-layer header injection may need to be applied at the reverse proxy or load balancer if the application itself does not support header configuration directly.