CVE-2026-3660
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.
Risk Assessment
An unauthenticated attacker can modify server configuration and gain unauthorized access to the application, potentially compromising data confidentiality and integrity.
Recommendation
Apply the patch from IBM or upgrade to a version that fixes this vulnerability.
Other vulnerabilities in IBM Engineering Lifecycle Management
See all- CVE-2026-14979Medium
IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001 through 021), 7.1.0 (Interim Fix 001 through 009), and 7.2.0 and 7.2.0 Interim Fix 001 DOORS are vulnerable to a denial of service attack due to improper handling of XML entity expansion.
- CVE-2026-4051High
Vulnerability in IBM Engineering Lifecycle Management versions 7.0.3, 7.1.0, and 7.2.0. An attacker with administrative privileges can execute remote code due to an improperly restricted method.
- CVE-2026-3603High
XML External Entity Injection (XXE) vulnerability in IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001-021), 7.1.0 (Interim Fix 001-009), and 7.2.0 and 7.2.0 Interim Fix 001. An authenticated attacker could exploit this to expose sensitive information or consume memory resources.
Original NVD description (English source)
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS