IBM Engineering Lifecycle Management CVE-2026-3603

Exploitation requires the attacker to hold valid authenticated credentials to the IBM Engineering Lifecycle Management application (CVSS PR:L), to reach an ELM endpoint that accepts and parses user-supplied XML data, and for the deployment to be running an affected build: 7.0.3 Interim Fix 001-021, 7.1.0 Interim Fix 001-009, or 7.2.0 / 7.2.0 Interim Fix 001. No user interaction by a victim is needed (UI:N), and no special non-default configuration is documented as required beyond the standard XML-processing functionality of the product. Limiting factors include the authentication requirement (which excludes purely external unauthenticated attackers), the typically internal/enterprise deployment posture of ELM, and S:U scope meaning impact is confined to the ELM application context rather than the underlying host.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L reflects a network-reachable, low-complexity bug requiring low-privilege authentication, with high confidentiality impact but no integrity impact and only low availability impact - a profile consistent with file/data disclosure plus memory exhaustion rather than full system compromise. The 7.1 base score significantly overstates real-world urgency: EPSS is 0.02% (5th percentile), SSVC reports Exploitation=none and Automatable=no, no KEV listing exists, and no public exploit identified at time of analysis. Because ELM deployments are typically internal engineering platforms with authenticated user populations, the practical risk is bounded by who already holds valid credentials; however, in environments where ELM is exposed to large internal user bases or contractors, an insider could realistically chain this with file reads of configuration material containing secrets. Treat this as a routine-priority patch rather than an emergency.

An attacker with valid low-privilege ELM credentials - for example, a contractor or a phished standard user - submits a crafted XML payload to an ELM endpoint that parses XML (such as an OSLC or import API), with a DOCTYPE declaring an external entity pointing to a local file or internal URL. The vulnerable parser resolves the entity and either returns its content in a response or error message, leaking files such as configuration files containing credentials, or alternatively triggers a recursive entity expansion to consume server memory and degrade service. No public exploit is identified at time of analysis, but XXE payload patterns are well-documented and trivial to construct.