← Back

CVE-2026-3603

nvd nist
Published: May 26, 2026Modified: Jul 24, 2026

JSON object

Loading...
7.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Exploitability: 2.8 / Impact: 4.2
Source: psirt@us.ibm.com (Secondary)

Description

IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through  Interim Fix 021, 7.1.0  Interim Fix 001 through  Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Affected (33)

Ibm
1 product
Engineering Lifecycle Management
Configuration A
33 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Engineering Lifecycle Management
Version 7.0.3
Engineering Lifecycle Management
Version 7.0.3 ifix002
Engineering Lifecycle Management
Version 7.0.3 ifix003
Engineering Lifecycle Management
Version 7.0.3 ifix004
Engineering Lifecycle Management
Version 7.0.3 ifix005
Engineering Lifecycle Management
Version 7.0.3 ifix006
Engineering Lifecycle Management
Version 7.0.3 ifix007
Engineering Lifecycle Management
Version 7.0.3 ifix008
Engineering Lifecycle Management
Version 7.0.3 ifix009
Engineering Lifecycle Management
Version 7.0.3 ifix010
Engineering Lifecycle Management
Version 7.0.3 ifix011
Engineering Lifecycle Management
Version 7.0.3 ifix012
Engineering Lifecycle Management
Version 7.0.3 ifix013
Engineering Lifecycle Management
Version 7.0.3 ifix014
Engineering Lifecycle Management
Version 7.0.3 ifix015
Engineering Lifecycle Management
Version 7.0.3 ifix016
Engineering Lifecycle Management
Version 7.0.3 ifix017
Engineering Lifecycle Management
Version 7.0.3 ifix018
Engineering Lifecycle Management
Version 7.0.3 ifix019
Engineering Lifecycle Management
Version 7.0.3 ifix020
Engineering Lifecycle Management
Version 7.0.3 ifix021
Engineering Lifecycle Management
Version 7.1.0
Engineering Lifecycle Management
Version 7.1.0 ifix001
Engineering Lifecycle Management
Version 7.1.0 ifix002
Engineering Lifecycle Management
Version 7.1.0 ifix003
Engineering Lifecycle Management
Version 7.1.0 ifix004
Engineering Lifecycle Management
Version 7.1.0 ifix005
Engineering Lifecycle Management
Version 7.1.0 ifix006
Engineering Lifecycle Management
Version 7.1.0 ifix007
Engineering Lifecycle Management
Version 7.1.0 ifix008
Engineering Lifecycle Management
Version 7.1.0 ifix009
Engineering Lifecycle Management
Version 7.2.0
Engineering Lifecycle Management
Version 7.2.0 ifix001

Related CWEs

CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (1)

Source: psirt@us.ibm.com
PatchVendor Advisory

Timeline

No history available yet.