CVE-2026-3603
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
XML External Entity Injection (XXE) vulnerability in IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001-021), 7.1.0 (Interim Fix 001-009), and 7.2.0 and 7.2.0 Interim Fix 001. An authenticated attacker could exploit this to expose sensitive information or consume memory resources.
Risk Assessment
An attacker could access sensitive data or cause a denial of service by exhausting memory, impacting confidentiality and availability.
Recommendation
Apply the appropriate Interim Fixes provided by IBM for the affected versions and restrict XML processing.
Other vulnerabilities in IBM Engineering Lifecycle Management
See all- CVE-2026-3660Critical
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.
- CVE-2026-14979Medium
IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001 through 021), 7.1.0 (Interim Fix 001 through 009), and 7.2.0 and 7.2.0 Interim Fix 001 DOORS are vulnerable to a denial of service attack due to improper handling of XML entity expansion.
- CVE-2026-4051High
Vulnerability in IBM Engineering Lifecycle Management versions 7.0.3, 7.1.0, and 7.2.0. An attacker with administrative privileges can execute remote code due to an improperly restricted method.
Original NVD description (English source)
IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.