CVE-2026-3603
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack
- Published
- Updated
- Reserved
- Assigned by
- ibm
Description
IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ibmCNA (assigner) | 3.1 | High7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L |
| NVDNVD · Analyzed | 3.1 | High7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L |
- EPSS (exploitation in 30 days)
- 0.35% · top 71% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
Affected products
IBM · Engineering Lifecycle Management
- affected 7.0.3 Interim Fix 001 – ≤ Interim Fix 021
- affected 7.1.0 Interim Fix 001 – ≤ Interim Fix 009
- affected 7.2.0 and 7.2.0 Interim Fix 001
What to do
Solution: IBM strongly recommends addressing the vulnerability now by upgrading to iFixes detailed below: Affected Product(s)Version(s)Remediation/Fix/Instructions IBM Engineering Lifecycle Management - Jazz Foundation 7.0.3Download and install iFix022 https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Engineering Lifecycle Management - Jazz Foundation 7.1.0Download and install iFix010 https://www.ibm.com/support/fixcentral/swg/downloadFixes IBM Engineering Lifecycle Management - Jazz Foundation 7.2.0Download and install iFix002 https://www.ibm.com/support/fixcentral/swg/downloadFixes
References (1)
- https://www.ibm.com/support/pages/node/7274078 (opens in a new tab)vendor-advisorypatch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-3603)Record last updated .