IBM ELM DOORS CVE-2026-14979

No special conditions - remote unauthenticated exploitation against default configurations of IBM Engineering Lifecycle Management DOORS where the service is network-accessible. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, elevated privilege, user interaction, or non-default configuration is required. The primary limiting factor is network reachability: organizations that restrict DOORS to isolated internal segments, require VPN access, or place it behind an authenticated reverse proxy significantly reduce exposure, as the attacker must be able to deliver an HTTP request to the DOORS endpoint. No specific feature toggle, protocol mode, or deployment variant is identified as a prerequisite.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly reflects a straightforward, unauthenticated, network-exploitable availability impact with low attack complexity. However, several signals moderate real-world priority: EPSS at 0.36% (28th percentile) indicates no current observed exploitation activity at scale; the vulnerability is not listed in CISA KEV; and no public proof-of-concept has been identified. The sole impact is availability - there is no confidentiality or integrity consequence, limiting attacker utility to disruption rather than data access or system compromise. IBM ELM DOORS is deployed primarily in regulated industries such as aerospace, defense, and automotive, giving it a niche but operationally sensitive footprint. The CVSS and EPSS signals are consistent: technically easy to exploit where the service is reachable, but not currently attracting broad attacker interest. Organizations with DOORS exposed to untrusted networks should treat remediation as moderate priority; air-gapped or VPN-only deployments face substantially reduced exposure.

An unauthenticated remote attacker sends a crafted HTTP request to an IBM ELM DOORS XML-processing endpoint, embedding a payload with dozens of nested entity references that expand exponentially when parsed. The DOORS XML parser attempts full entity expansion without enforcing limits, exhausting server memory or CPU within seconds and rendering the DOORS requirements management service unavailable to all users. The Billion Laughs attack pattern is publicly documented and trivially reproducible, though no DOORS-specific public exploit code has been identified at time of analysis.