IBM Engineering Lifecycle Management CVE-2026-3660

No special conditions - remote unauthenticated network access to the IBM Engineering Lifecycle Management server's HTTP(S) interface against default configurations of versions 7.0.3 ≤IF021, 7.1.0 ≤IF009, or 7.2.0 ≤IF001 is sufficient (CVSS AV:N/AC:L/PR:N/UI:N). The primary limiting factor is exposure: ELM is typically an internal enterprise application, so exploitation requires the attacker to already be on a network segment that can reach the server (corporate LAN, VPN, or any internet-exposed instance). No user interaction, no prior credentials, and no non-default feature toggles are required per the description and CVSS vector.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated, no-user-interaction flaw with total CIA impact - the worst-case profile. SSVC reinforces this: Automatable=yes and Technical Impact=total, both of which would prioritize this in CISA's decision framework. However, SSVC Exploitation=none and EPSS at 0.03% (10th percentile) indicate that no active exploitation or public exploit code has been observed, and the vulnerability is not on the CISA KEV list. The realistic posture is that this is a high-priority patch for any internet-exposed or broadly-reachable ELM deployment because exploitation would be trivial once a technique is published, but there is no evidence of in-the-wild use yet. Defenders should treat the CVSS/SSVC severity as the dominant signal and not be reassured by the low EPSS, since EPSS often lags for niche enterprise products with small attack surfaces on the public internet.

An attacker with network reachability to the ELM server sends crafted requests to the vulnerable property-update endpoint without supplying credentials, modifying server configuration to grant themselves an administrative account or weaken authentication settings. They then log in as a privileged user and access or tamper with engineering artifacts (requirements, source linkages, test plans), potentially pivoting to other integrated systems. No public exploit identified at time of analysis, but SSVC Automatable=yes indicates a working technique could be scripted at scale once disclosed.