What is the CVSS score of CVE-2026-56586?

CVE-2026-56586 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Intelliops Event Management CVE-2026-56586

EUVD-2026-46279 MEDIUM

Configuration (CWE-16)

2026-07-21 HCL

GHSA-qr5c-r7w7-xcqh

Information Disclosure Intelliops Event Management

4.2

CVSS 3.1 · NVD

Severity by source

Vendor (HCL) PRIMARY

LOW

qualitative

NVD

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

3.1 LOW

Network-accessible (browser-reachable), high complexity (MITM positioning required), no privileges needed, user interaction required, low integrity impact only, no confidentiality or availability impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:R/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jul 30, 2026 - 13:08 NVD

LOW MEDIUM

CVSS changed

Jul 30, 2026 - 13:08 NVD

3.1 (LOW) 4.2 (MEDIUM)

Analysis Generated

Jul 21, 2026 - 15:47 vuln.today

DescriptionNVD

HCL IEM was affected with X-Content-Type-Options Header Missing. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and intercept sensitive data.

AnalysisAI

Missing X-Content-Type-Options headers in Intelliops Event Management enable content-type sniffing attacks leading to script injection under man-in-the-middle conditions when user-controlled input is reflected. Exploitation requires high attack complexity, user browser interaction, and network positioning, with low integrity impact only (CVSS 3.1). No active exploitation or public exploit code identified.

Technical ContextAI

The X-Content-Type-Options HTTP response header instructs browsers to disable MIME-type sniffing, a legacy behavior where browsers guess file types based on content rather than declared headers. Without this header, attackers can deliver malicious scripts disguised as images, documents, or other content types, potentially triggering script execution in victim browsers. When combined with application reflection of user-controlled input, this creates a cross-site scripting (XSS) vector. The vulnerability is classified under CWE-16 (configuration management). HCL Intelliops Event Management is affected across all versions per the CPE wildcard.

RemediationAI

Apply the X-Content-Type-Options: nosniff header to all HTTP response headers returned by Intelliops Event Management. Refer to HCL support article KB0132378 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132378) for implementation guidance. No vendor-released patch identified-remediation requires server-side configuration change, typically performed via application middleware, reverse proxy headers (nginx, Apache), or application framework configuration. Ensure the header is present on all endpoints including error pages, redirects, and API responses. Test with browser developer tools (Network tab) to confirm header presence.