Critical severity · published May 26, 2026
CVE-2026-3660
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Engineering Lifecycle Management · IBM
7.0.3 through Interim Fix 021; 7.1.0 through Interim Fix 009; 7.2.0 through Interim Fix 001 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3660
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3660
Vendor Advisory
https://www.ibm.com/support/pages/node/7274079
More from Engineering Lifecycle Management
8.8
CVE-2020-4495
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control
7.5
CVE-2026-14979
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
7.5
CVE-2020-4965
IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
7.2
CVE-2026-4051
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution
7.1
CVE-2026-3603
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack