IBM Engineering Lifecycle Management EUVD-2026-31951

Exploitation requires the attacker to already hold administrative privileges on the target IBM Engineering Lifecycle Management instance (CVSS PR:H), network reachability to the ELM web interface (AV:N), and an unpatched 7.0.3 ≤IF021, 7.1.0 ≤IF009, or 7.2.0 ≤IF001 deployment; no user interaction by a second party is needed (UI:N) and attack complexity is low (AC:L) once admin access is held. The exposed-method vulnerability (CWE-749) is reached through normal admin-authenticated channels, so what limits exploitation in practice is the strength and exposure of ELM administrator credentials and whether the admin console is network-restricted; internet-exposed ELM with weak admin auth represents the realistic worst case.

Signals are mixed and point to a high-impact but low-likelihood scenario. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms the attacker must already hold high privileges (administrative) on the ELM instance, which sharply reduces the realistic attacker pool; correspondingly EPSS is only 0.01% (3rd percentile) and SSVC reports Exploitation: none and Automatable: no. However, SSVC Technical Impact is total and CVSS confidentiality, integrity, and availability impacts are all High, consistent with remote code execution. The vulnerability is not on CISA KEV and no public exploit was identified at time of analysis. The 'Information Disclosure' tag conflicts with the description and CVSS impacts (which describe RCE), and should be treated as a likely mis-tag rather than a separate signal. Net: prioritize patching where untrusted administrators exist or where admin credential compromise is plausible (e.g., ELM accessible from broad internal networks), but this is not an emergency for hardened, internally-scoped deployments.

An attacker who has obtained ELM administrative credentials (via phishing, credential reuse, or insider access) authenticates to the ELM web interface over the network and invokes the exposed unrestricted method, causing arbitrary code to run in the context of the Jazz Team Server process. From there the attacker can read or modify requirements, test, and workflow data across projects, pivot to the underlying host, and target adjacent enterprise systems integrated with ELM. No public exploit was identified at time of analysis.