CVE-2026-14979
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001 through 021), 7.1.0 (Interim Fix 001 through 009), and 7.2.0 and 7.2.0 Interim Fix 001 DOORS are vulnerable to a denial of service attack due to improper handling of XML entity expansion.
Risk Assessment
A remote attacker can exploit this vulnerability to overload the system, causing a denial of service and disrupting engineering tools.
Recommendation
Apply the available patches (Interim Fix) for affected versions of IBM Engineering Lifecycle Management immediately to mitigate the DoS risk.
Other vulnerabilities in IBM Engineering Lifecycle Management
See all- CVE-2026-3660Critical
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.
- CVE-2026-4051High
Vulnerability in IBM Engineering Lifecycle Management versions 7.0.3, 7.1.0, and 7.2.0. An attacker with administrative privileges can execute remote code due to an improperly restricted method.
- CVE-2026-3603High
XML External Entity Injection (XXE) vulnerability in IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001-021), 7.1.0 (Interim Fix 001-009), and 7.2.0 and 7.2.0 Interim Fix 001. An authenticated attacker could exploit this to expose sensitive information or consume memory resources.
Original NVD description (English source)
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.