High severity · published May 26, 2026
CVE-2026-4051
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an attacker with administrative privileges to execute remote code due to exposed method that is not properly restricted.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Engineering Lifecycle Management · IBM
7.0.3 through Interim Fix 021; 7.1.0 through Interim Fix 009; 7.2.0 through Interim Fix 001 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-4051
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-4051
Vendor Advisory
https://www.ibm.com/support/pages/node/7274077
More from Engineering Lifecycle Management
9.8
CVE-2026-3660
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass
8.8
CVE-2020-4495
IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to bypass security restrictions, caused by improper access control
7.5
CVE-2026-14979
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
7.5
CVE-2020-4965
IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
7.1
CVE-2026-3603
IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack