What is the CVSS score of CVE-2026-14979?

CVE-2026-14979 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM ELM DOORS are affected by CVE-2026-14979?

IBM Engineering Lifecycle Management DOORS component is vulnerable to unauthenticated denial-of-service attacks via specially crafted XML payloads, potentially disrupting engineering workflows and…

How to fix or mitigate CVE-2026-14979?

Within 24 hours: Inventory all DOORS deployments and identify which are accessible from untrusted networks (internet, guest networks); restrict network access to DOORS to known engineering teams only using firewall rules or VPN requirements. Within 7 days: Contact IBM support to confirm your deployment versions (7.0.3-IF021, 7.1.0-IF009, or 7.2.0-IF001) and subscribe to security notifications for patches; deploy or configure Web Application Firewall rules to block XML entity expansion patterns (recursive DTD declarations). Within 30 days: Implement rate limiting on XML submission endpoints and evaluate IBM's published compensating controls or upgrade timeline; enable detailed DOORS access logging to detect exploit attempts.

IBM ELM DOORS CVE-2026-14979

EUVD-2026-45300 HIGH

Improper Restriction of Recursive Entity References in DTDs (CWE-776)

2026-07-17 psirt@us.ibm.com

GHSA-w545-wjm2-rf4h

IBM Denial Of Service Engineering Lifecycle Management

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-accessible XML endpoint requires no authentication; impact is solely availability exhaustion with no scope change, confidentiality, or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 11, 2026 - 23:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 11, 2026 - 23:22 vuln.today

cvss_changed

Severity Changed

Aug 11, 2026 - 23:22 NVD

MEDIUM HIGH

CVSS changed

Aug 11, 2026 - 23:22 NVD

5.3 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jul 17, 2026 - 20:36 vuln.today

DescriptionNVD

IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.

AnalysisAI

Denial of service in IBM Engineering Lifecycle Management's DOORS component exposes unauthenticated remote attackers to crash or degrade the service by submitting XML payloads exploiting recursive entity expansion. Affected deployments span three active release branches - 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 including Interim Fix 001. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.36% (28th percentile) confirms low current exploitation activity, but the unauthenticated network vector makes remediation advisable for internet-facing or low-trust-network deployments.

Technical ContextAI

CWE-776 (Improper Restriction of Recursive Entity References in DTDs) covers the class of attacks commonly called 'Billion Laughs,' where an XML parser expands deeply nested or self-referential entity definitions, causing exponential memory or CPU consumption. IBM Engineering Lifecycle Management is an enterprise application lifecycle management suite; the DOORS sub-component (Dynamic Object-Oriented Requirements System) provides requirements management and ingests structured XML data. NVD CPE data confirms affected instances under cpe:2.3:a:ibm:engineering_lifecycle_management:7.0.3 through multiple interim fix levels, and EUVD extends confirmed coverage to the 7.1.0 and 7.2.0 branches. The root cause is the absence of entity expansion limits or entity count caps in the XML parser serving DOORS endpoints, a well-understood class of parser misconfiguration.

RemediationAI

Apply the IBM-released fix per the advisory at https://www.ibm.com/support/pages/node/7279963 - the specific patched interim fix version must be confirmed directly from that advisory, as no exact fix version number was provided in available intelligence data. If immediate patching is not operationally feasible, restrict network access to DOORS endpoints to authenticated internal network segments via perimeter firewall rules, eliminating unauthenticated external exposure and reducing risk to near zero for that attack vector. As an additional compensating control, deploying an XML-aware web application firewall rule to detect and reject payloads with excessive entity nesting depth or count can block Billion Laughs-style payloads; note that overly aggressive WAF thresholds may reject legitimate large XML submissions and will require tuning against production traffic patterns. Patch version not independently confirmed from available data - verify the exact fixed interim fix number directly from the IBM PSIRT advisory before deployment.