CVE-2026-3603

HIGH

IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack

Title source: cna
STIX 2.1

Description

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through  Interim Fix 021, 7.1.0  Interim Fix 001 through  Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7274078

Scores

CVSS v3 7.1
EPSS 0.0035
EPSS Percentile 27.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-611
Status published
Products (9)
IBM/Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 - ) Interim Fix 021
IBM/Engineering Lifecycle Management 7.0.3 Interim Fix 001 - Interim Fix 021
IBM/Engineering Lifecycle Management 7.1.0 ( Interim Fix 001 - ) Interim Fix 009
IBM/Engineering Lifecycle Management 7.1.0 Interim Fix 001 - Interim Fix 009
IBM/Engineering Lifecycle Management 7.2.0 and 7.2.0 Interim Fix 001
IBM/Engineering Lifecycle Management 7.2.0 and 7.2.0 Interim Fix 001 - Interim Fix 001
ibm/engineering_lifecycle_management 7.0.3 (21 CPE variants)
ibm/engineering_lifecycle_management 7.1.0 (10 CPE variants)
ibm/engineering_lifecycle_management 7.2.0 (2 CPE variants)
Published May 26, 2026
Tracked Since May 27, 2026