CVE-2026-4051
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in IBM Engineering Lifecycle Management versions 7.0.3, 7.1.0, and 7.2.0. An attacker with administrative privileges can execute remote code due to an improperly restricted method.
Risk Assessment
Risk includes full server compromise by an administrator, potentially leading to data theft or disruption of engineering processes.
Recommendation
Apply the IBM patch when released; restrict administrative privileges to a minimum.
Other vulnerabilities in IBM Engineering Lifecycle Management
See all- CVE-2026-3660Critical
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.
- CVE-2026-14979Medium
IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001 through 021), 7.1.0 (Interim Fix 001 through 009), and 7.2.0 and 7.2.0 Interim Fix 001 DOORS are vulnerable to a denial of service attack due to improper handling of XML entity expansion.
- CVE-2026-3603High
XML External Entity Injection (XXE) vulnerability in IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001-021), 7.1.0 (Interim Fix 001-009), and 7.2.0 and 7.2.0 Interim Fix 001. An authenticated attacker could exploit this to expose sensitive information or consume memory resources.
Original NVD description (English source)
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with administrative privileges to execute remote code due to exposed method that is not properly restricted.