What is the CVSS score of CVE-2026-4051?

CVE-2026-4051 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of IBM Engineering Lifecycle Management are affected by CVE-2026-4051?

IBM Engineering Lifecycle Management (ELM) versions 7.0.3 through 7.2.0 contain a vulnerability allowing a compromised or malicious administrator to gain complete control over the platform and all…. A patch is available.

How to fix or mitigate CVE-2026-4051?

Within 24 hours: Inventory all ELM instances and affected versions (7.0.3-IF021, 7.1.0-IF009, 7.2.0-IF001); audit and reduce ELM administrative account scope. Within 7 days: Apply IBM vendor-released patch to all affected ELM instances. Within 30 days: Validate patching completion and enforce least-privilege administrative access controls across the environment.

IBM Engineering Lifecycle Management CVE-2026-4051

EUVD-2026-31951 HIGH

Exposed Dangerous Method or Function (CWE-749)

2026-05-26 ibm

GHSA-p33w-c5h4-h687

Information Disclosure IBM Engineering Lifecycle Management

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:16 vuln.today

DescriptionCVE.org

IBM Engineering Lifecycle Management 7.0.3 ( through ) Interim Fix 021, 7.1.0 ( through ) Interim Fix 009, and 7.2.0 ( through ) Interim Fix 001 could allow an attacker with administrative privileges to execute remote code due to exposed method that is not properly restricted.

AnalysisAI

Remote code execution in IBM Engineering Lifecycle Management (ELM) versions 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 through Interim Fix 001 allows an attacker with administrative privileges to execute arbitrary code via an exposed method that is not properly restricted (CWE-749). At time of analysis there is no public exploit identified and EPSS is very low (0.01%), but the SSVC technical impact is rated total, making this a high-impact post-authentication issue against ELM administrators. IBM has published a patch advisory and CVSS is 7.2 (AV:N/AC:L/PR:H/UI:N/C:H/I:H/A:H).

Technical ContextAI

IBM Engineering Lifecycle Management is an enterprise application lifecycle and requirements management suite (formerly Rational/Jazz-based products such as DOORS Next, Engineering Workflow Management, Engineering Test Management) typically deployed on WebSphere Liberty/Jazz Team Server stacks. CWE-749 (Exposed Dangerous Method or Function) indicates that an internal administrative or management method was reachable through the application's interface without sufficient restrictions, allowing an authenticated administrator to invoke functionality that crosses the boundary into arbitrary code execution on the server. The CPE cpe:2.3:a:ibm:engineering_lifecycle_management:*:*:*:*:*:*:*:* confirms the affected product family without narrowing further at the version level, so the EUVD/IBM-supplied version ranges are the authoritative scoping source.

RemediationAI

Apply the patch available per vendor advisory at https://www.ibm.com/support/pages/node/7274077, upgrading beyond Interim Fix 021 on 7.0.3, beyond Interim Fix 009 on 7.1.0, and beyond Interim Fix 001 on 7.2.0 (exact fixed Interim Fix designations should be taken from the IBM support page, which is the authoritative source). Until the patch is rolled out, treat ELM administrator accounts as Tier-0: enforce MFA on all admin logins, restrict administrative console access to a dedicated jump-host or VPN segment rather than exposing it to the corporate network, audit and reduce the membership of ELM administrative groups, and monitor application and OS-level logs on the Jazz Team Server for unexpected process creation by the WebSphere/Liberty service account - the trade-off is operational friction for administrators and additional logging volume, with no functional loss to end users.