IntelliOps IEM EUVD-2026-63323

Exploitation requires a user holding high-privileged credentials in IEM (PR:H per CVSS vector) to actively visit an attacker-controlled web page in the same browser where an IEM session is active (UI:R). The attack is strictly browser-mediated: CORS header absence is only exploitable when a browser enforces the same-origin policy and forwards session cookies cross-origin - server-to-server tooling, API clients, and command-line tools cannot trigger this vulnerability class. The IEM web interface must be reachable from the victim's browser, meaning fully air-gapped deployments are not exposed via this vector. Exploitation does not apply to low-privileged IEM user sessions if high-privilege access is required to reach sensitive endpoints. The combination of required victim privilege level and mandatory user interaction limits this to targeted attacks rather than opportunistic scanning.

The CVSS 4.8 Medium score reflects a meaningful but constrained attack surface: the two most significant limiters are PR:H (the victim must hold high-privileged IEM credentials) and UI:R (the victim must actively visit an attacker-controlled page while authenticated). These prerequisites considerably reduce the realistic threat population compared to a fully unauthenticated, no-interaction flaw. The Scope:Changed metric elevates the score modestly above what C:L/I:L/A:N would otherwise yield, because the cross-origin boundary crossing extends impact beyond IEM itself into the victim's browser context. No EPSS probability was supplied and IEM is not listed in the CISA KEV catalog, indicating no confirmed widespread or active exploitation at time of analysis. The CPE wildcard version (iem:*) means the full affected version range has not been formally bounded in NVD, introducing some uncertainty about exposure scope. On balance, this is a real but lower-urgency issue: the exploitation path requires a targeted social engineering step against a privileged user, making opportunistic mass exploitation unlikely, though a motivated attacker pursuing a specific high-privilege IEM administrator could plausibly execute it.

An attacker registers or compromises a publicly reachable web page and embeds JavaScript that issues fetch requests with credentials to a target organization's IEM instance. A high-privileged IEM user is lured to this page - via a phishing email or malicious link - while their IEM browser session is active; because IEM returns overly permissive or absent CORS headers, the browser forwards the session cookie and allows the attacker's script to read the IEM API response, potentially harvesting event data, configuration details, or user information. No public proof-of-concept exploit has been identified at time of analysis, so exploitation requires manual construction of the attack page.