What is the CVSS score of CVE-2026-3603?

CVE-2026-3603 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of IBM Engineering Lifecycle Management are affected by CVE-2026-3603?

IBM Engineering Lifecycle Management versions 7.0.3, 7.1.0, and 7.2.0 contain an XML External Entity injection vulnerability that allows authenticated users to extract sensitive information or…. A patch is available.

How to fix or mitigate CVE-2026-3603?

Within 24 hours: Identify and document all ELM instances, versions, and data classification (which teams depend on these systems). Within 7 days: Obtain patch from IBM, test in non-production environment matching your ELM deployment. Within 30 days: Deploy patched version to all affected systems (7.0.3, 7.1.0, 7.2.0) on a staged schedule aligned with change control windows.

IBM Engineering Lifecycle Management CVE-2026-3603

EUVD-2026-31952 HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2026-05-26 ibm

GHSA-2589-88hx-72gf

XXE IBM Engineering Lifecycle Management

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:12 vuln.today

DescriptionCVE.org

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

AnalysisAI

XML External Entity (XXE) injection in IBM Engineering Lifecycle Management (ELM) 7.0.3, 7.1.0, and 7.2.0 allows authenticated attackers to disclose sensitive information or exhaust memory resources by submitting crafted XML data to the application. The flaw carries a CVSS 7.1 (High) rating with low attack complexity over the network, but EPSS is only 0.02% (5th percentile) and there is no public exploit identified at time of analysis. SSVC classifies exploitation as 'none' with partial technical impact, indicating low immediate urgency despite the vendor-released patch.

Technical ContextAI

The vulnerability is rooted in CWE-611 (Improper Restriction of XML External Entity Reference), a class of bug in which an XML parser resolves external entities defined inside a DOCTYPE declaration without restriction. When the IBM ELM application processes attacker-supplied XML, the parser can be coerced into fetching local files, internal network resources, or expanding entities recursively to exhaust memory (billion-laughs style). The affected product, per CPE cpe:2.3:a:ibm:engineering_lifecycle_management, is IBM's integrated suite for requirements, change, and quality management across Engineering Workflow Management, DOORS Next, and related Jazz-platform components, which commonly exchange XML payloads via REST and OSLC interfaces.

RemediationAI

Apply the vendor-released patch referenced in the IBM advisory at https://www.ibm.com/support/pages/node/7274078, which addresses the affected 7.0.3, 7.1.0, and 7.2.0 Interim Fix levels - the input data confirms a patch is available from IBM but does not specify a single fixed Interim Fix number, so consult the advisory for the exact remediated build for your branch. As a compensating control until patching, restrict ELM application accounts to the minimum trusted user population (since exploitation requires authentication), audit and tighten network egress from the ELM server to prevent out-of-band data exfiltration via XXE callbacks, and monitor for unusual outbound DNS/HTTP traffic from the ELM JVM; note that disabling XML ingestion entirely is generally not feasible because OSLC and REST integrations depend on it. If your deployment uses external XML-consuming integrations, validate that those endpoints sit behind authenticated, internal-only network paths.