PT-2026-43374 · Ibm · Engineering Lifecycle Management

Chudypb + 1 · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-3603

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions IBM Engineering Lifecycle Management versions 7.0.3 Interim Fix 001 through Interim Fix 021 IBM Engineering Lifecycle Management versions 7.1.0 Interim Fix 001 through Interim Fix 009 IBM Engineering Lifecycle Management versions 7.2.0 through 7.2.0 Interim Fix 001

Description An XML external entity (XXE) injection occurs when processing XML data, which is a technique where an application processes external entities within an XML document. An authenticated attacker can exploit this to expose sensitive information or consume memory resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-3603

Affected Products

Engineering Lifecycle Management

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-3603 · Security Note
• https://t.me/CVEtracker/55009 · Telegram Post
• https://ibm.com/support/pages/node/7274078 · Patch, Vendor Advisory