by Kastro
Paper/Archive/CVE-2026-3660

CVE-2026-3660

IBM Engineering Lifecycle Management — IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.7.477 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.

Affected

ProductAffectedFixed inSource
Engineering Lifecycle Management7.0.3 – Interim Fix 021–CNA
Engineering Lifecycle Management7.1.0 – Interim Fix 009–CNA
Engineering Lifecycle Management7.2.0 – Interim Fix 001–CNA

Scores by source

ibm (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchibm.com/support/pages/node/7274079