What is the CVSS score of CVE-2026-3660?

CVE-2026-3660 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of IBM Engineering Lifecycle Management are affected by CVE-2026-3660?

IBM Engineering Lifecycle Management (ELM) versions 7.0.3, 7.1.0, and 7.2.0 contain a critical authorization bypass vulnerability enabling unauthenticated remote attackers to modify server…. A patch is available.

How to fix or mitigate CVE-2026-3660?

Within 24 hours: Identify all systems running IBM ELM 7.0.3, 7.1.0, or 7.2.0 and isolate high-risk instances from untrusted networks. Within 7 days: Apply IBM-released Interim Fixes to all affected ELM installations and validate deployment in test environments. Within 30 days: Complete production patching across all instances, conduct security testing to confirm authorization controls function as intended, and review access logs for unauthorized activity during vulnerability window.

IBM Engineering Lifecycle Management CVE-2026-3660

EUVD-2026-31954 CRITICAL

Incorrect Authorization (CWE-863)

2026-05-26 ibm

GHSA-cxh9-m8x4-52q5

Authentication Bypass IBM Engineering Lifecycle Management

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:30 vuln.today

DescriptionCVE.org

IBM Engineering Lifecycle Management 7.0.3 ( through ) Interim Fix 021, 7.1.0 ( through ) Interim Fix 009, and 7.2.0 ( through ) Interim Fix 001 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.

AnalysisAI

Authorization bypass in IBM Engineering Lifecycle Management (ELM) 7.0.3, 7.1.0, and 7.2.0 allows unauthenticated remote attackers to modify server property files and gain unauthorized access to the application. The flaw carries a critical CVSS 9.8 score with full confidentiality, integrity, and availability impact, and IBM has released Interim Fixes addressing it. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.03%, 10th percentile).

Technical ContextAI

IBM Engineering Lifecycle Management is an enterprise suite for application lifecycle management used across requirements, design, quality, and configuration management workflows (covered by cpe:2.3:a:ibm:engineering_lifecycle_management). The root cause is CWE-863 (Incorrect Authorization), meaning the application performs an authorization check but applies the wrong logic or fails to enforce restrictions on a privileged action. In this case, the server exposes a code path that allows modification of property files - configuration data that the server trusts at runtime - without first validating that the caller is authenticated or authorized, effectively turning a configuration management primitive into an authentication bypass.

RemediationAI

Apply the IBM-released Interim Fixes documented at https://www.ibm.com/support/pages/node/7274079 - specifically upgrade beyond Interim Fix 021 for 7.0.3, beyond Interim Fix 009 for 7.1.0, and beyond Interim Fix 001 for 7.2.0 (Patch available per vendor advisory). Until the fix is applied, restrict network access to ELM server endpoints to trusted management networks or VPN-only reachability via firewall or reverse-proxy ACLs, which neutralizes the AV:N attack vector at the cost of breaking remote integrations and external client tooling. Additionally, monitor for unexpected writes to server property files on ELM hosts and review property-file integrity against a known-good baseline; this is a detection-only control and will not block exploitation, but it provides high-fidelity evidence of an attempt.