CVE-2017-13989: An improper access control vulnerability in ArcSight ESM and ArcSight ESM Express, any 6.x version prior to...

Security readout for executives and security teams

ArcSight ESM/ESM Express 6.x before specified HPE patches had an access-control flaw that could let unauthorized users view or change storage information. For a SIEM, that can affect monitoring integrity, but the public bundle does not provide CVSS, prerequisites, or exploitation evidence. Exposure is likely limited to organizations running affected ArcSight ESM or ESM Express 6.x builds. Risk depends on whether relevant ESM interfaces are reachable by unauthorized users; the source bundle does not specify network exposure requirements. Prioritize remediation if ArcSight ESM supports security monitoring or compliance reporting. Integrity issues in SIEM infrastructure can reduce confidence in detections and investigations, even without public exploitation evidence. Mitigation focus: Identify all ArcSight ESM and ESM Express 6.x deployments.; Upgrade to 6.9.1c Patch 4, 6.11.0 Patch 1, or later vendor-supported guidance.; Restrict ESM administrative and storage-related interfaces to trusted networks and users..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.