What is the CVSS score of CVE-2026-56587?

CVE-2026-56587 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

IntelliOps IEM CVE-2026-56587

EUVD-2026-46274 LOW

Unprotected Transport of Credentials (CWE-523)

2026-07-21 HCL

GHSA-9q58-6g9f-9x3r

Information Disclosure Intelliops Event Management

3.7

CVSS 3.1 · Vendor: HCL

Severity by source

Vendor (HCL) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

3.7 LOW

MITM network position required (AC:H); no auth needed; only limited confidentiality loss from traffic interception; no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorVendor: HCL

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 15:06 vuln.today

DescriptionCVE.org

HCL IEM was affected with Strict transport security not enforced. It may enable attackers to perform SSL stripping or man-in-the-middle attacks and compromise secure communications.

AnalysisAI

HCL IntelliOps Event Management (IEM) fails to enforce HTTP Strict Transport Security (HSTS), enabling network-positioned attackers to perform SSL stripping and intercept communications that should be protected by TLS. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates unauthenticated network exploitation but at high attack complexity, meaning the attacker must occupy a man-in-the-middle position on the network path. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing realistic risk in the low-to-moderate range confined to adversarial network environments.

Technical ContextAI

CWE-523 (Missing Encryption of Sensitive Data, specifically absent HSTS enforcement) is the root cause class. HTTP Strict Transport Security (RFC 6797) is a web security mechanism that instructs HTTP clients to communicate exclusively over HTTPS for a specified duration. Without the Strict-Transport-Security response header, browsers and API clients may initiate plain HTTP connections or follow insecure redirects, creating a window for SSL stripping attacks - a technique that downgrades HTTPS to HTTP by intercepting the initial plaintext request before a secure channel is established. The affected product per CPE (cpe:2.3:a:hclsoftware:intelliops_event_management:*:*:*:*:*:*:*:*) is HCL Software's IntelliOps Event Management across all tracked versions, indicating no version range has been excluded from the advisory.

RemediationAI

Consult the HCL Software vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132378 for the primary fix, which is expected to involve enabling the Strict-Transport-Security HTTP response header on IEM web interfaces. No specific patched version number is confirmed in the available input data - the patch version should be verified directly against the KB article. As a compensating control pending patch application, administrators can enforce HSTS at the perimeter layer (load balancer, reverse proxy, or WAF) by injecting the Strict-Transport-Security header with a suitable max-age value (e.g., 31536000 seconds); note this approach requires that all traffic passes through the enforcing proxy and will not protect direct API or client connections that bypass it. Additionally, restricting IEM to network segments where MITM is not feasible (isolated management VLANs, VPN-only access) reduces exposure independent of the HSTS gap.