CVE-2017-13987: An insufficient access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prio...

Security readout for executives and security teams

ArcSight ESM could let an unauthorized user download log files on affected 6.x versions. For executives, the main concern is exposure of security monitoring logs, which may contain incident details, usernames, infrastructure information, or investigation context. Likely exposure is limited to organizations running ArcSight ESM or ESM Express 6.x below the named fixed patch levels. The sources do not specify internet exposure, required privileges, or deployment conditions. Treat as a near-term remediation item for any still-running ArcSight 6.x environment. The issue affects confidentiality of security logs, but public evidence provided here does not support emergency active-exploitation handling. Mitigation focus: Identify all ArcSight ESM and ESM Express 6.x deployments.; Upgrade affected systems to 6.9.1c Patch 4, 6.11.0 Patch 1, or later vendor guidance.; Restrict access to ESM administrative and log-management interfaces..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.