CVE-2025-62299

HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

Published Aug 20, 2026 CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Description

HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.

Analysis

Technical impact

HCL IntelliOps Event Management contains a least‑privilege violation that permits an attacker who already holds some level of access to elevate privileges and reach resources that should otherwise be inaccessible. This flaw is categorized as CWE‑272.

Affected Systems

HCL IntelliOps Event Management, developed by HCL Software, lacks specified version information, so all releases are potentially vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 6.6 indicates moderate risk. The EPSS score is not supplied, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no public evidence of exploitation yet. The exact attack vector is not indicated in the advisory, so it may be remote or local, but this is inferred.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

HCL Software

IEM

unaffected

Version	Status	Constraints
`v1.4.0`	affected	—

No data.

Vendor Product Versions

Hcl Software

Iem

Version	Status	Scheme	Platform
`v1.4.0`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official patch or update for HCL IntelliOps Event Management as released by HCL Software.
Ensure all users and accounts follow the principle of least privilege, revoking any unnecessary elevated permissions.
Audit IEM configurations and logs to detect unauthorized privilege use and adjust settings accordingly.

Generated by OpenCVE AI on August 20, 2026 at 22:25 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.256% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132456

History

Aug 27, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 21, 2026 12:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Hcl Software Hcl Software iem
Vendors & Products		Hcl Software Hcl Software iem

Aug 20, 2026 12:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.
Title		HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
Weaknesses		CWE-272
References		https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132456
Metrics		cvssV3_1 `{'score': 6.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N'}`