High severity · published May 26, 2026
CVE-2026-3603
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Engineering Lifecycle Management · IBM
7.0.3 Interim Fix 001 through Interim Fix 021; 7.1.0 Interim Fix 001 through Interim Fix 009; 7.2.0 and 7.2.0 Interim Fix 001 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3603
Patch
https://www.ibm.com/support/pages/node/7274078
More from Engineering Lifecycle Management
9.8
CVE-2026-3660
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass
8.8
CVE-2020-4495
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control
7.5
CVE-2026-14979
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
7.5
CVE-2020-4965
IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
7.2
CVE-2026-4051
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution