CVE-2026-21784: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in HCL Software IEM

CVE-2026-21784 affects HCL Software's IntelliOps Event Management (IEM) version 1.4.0. The vulnerability arises from missing or insecure Cross-Origin Security headers, which can allow unauthorized external actors to interact with the application's environment and resources. This exposure can lead to leakage of sensitive information (CWE-200). The CVSS 3.1 base score is 4.8 with vector AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, high privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No exploits are known in the wild and no vendor patch or advisory has been provided.

The vulnerability may allow unauthorized external actors to access sensitive information due to insecure or missing Cross-Origin Security headers. The impact is limited to confidentiality and integrity with low severity, requiring high privileges and user interaction for exploitation. There is no impact on availability. No active exploitation has been reported.

No official patch or remediation has been provided by the vendor at this time. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider implementing strict Cross-Origin Resource Sharing (CORS) policies and review their web security headers to mitigate potential exposure risks.