IntelliOps IEM CVE-2026-56587

Exploitation requires the attacker to occupy a man-in-the-middle network position between the IEM client (browser or API consumer) and the IEM server - this is the AC:H condition from the CVSS vector. The victim's HTTP client must initiate or follow an unprotected HTTP connection rather than a directly pinned HTTPS session; clients that have previously cached an HSTS policy via a prior secure connection would not be vulnerable. No authentication is required of the attacker (PR:N), and no user interaction beyond normal application use is needed (UI:N). Exploitation is limited to confidentiality only (C:L); no writes or service disruption are achievable through this vector alone. Environments where all IEM traffic is confined to encrypted tunnels (IPSec, WireGuard, VPN) or where network-layer HSTS injection is performed by a perimeter proxy are partially protected independent of the application fix.

The CVSS base score of 3.7 (Low) is consistent with the underlying mechanics: AC:H reflects the prerequisite of a privileged network position (man-in-the-middle), and the impact is limited to C:L (partial confidentiality loss) with no integrity or availability consequences. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC or exploit code is referenced. The practical threat is narrow: exploitation requires the attacker to already control or observe network traffic between the IEM client and server, such as via a rogue access point, compromised network appliance, or ARP poisoning on a shared segment. In zero-trust or TLS-inspection environments this risk may be partially mitigated by infrastructure controls, but the absence of HSTS still represents a defense-in-depth gap. Overall, this is a low-priority finding for most enterprise environments but material for deployments on untrusted network segments.

An attacker who has achieved a man-in-the-middle position on the network path - for example via ARP poisoning on a shared LAN segment or a rogue Wi-Fi access point - intercepts a user's initial HTTP request to the IEM interface before TLS is negotiated. Without HSTS instructing the client to enforce HTTPS, the attacker relays a plaintext HTTP session and passively reads session tokens, credentials, or event management data in transit. No exploit code is publicly referenced, and the high attack complexity makes opportunistic exploitation unlikely.