PT-2026-43375 · Ibm · Engineering Lifecycle Management

Published 2026-05-26 · Updated 2026-05-28 · CVE-2026-3660

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Engineering Lifecycle Management versions 7.0.3 through Interim Fix 021 IBM Engineering Lifecycle Management versions 7.1.0 through Interim Fix 009 IBM Engineering Lifecycle Management versions 7.2.0 through Interim Fix 001

Description An unauthenticated remote attacker can update server property files, which may lead to unauthorized access to the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-3660

Affected Products

Engineering Lifecycle Management

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-3660 · Security Note
• https://ibm.com/support/pages/node/7274079 · Patch, Vendor Advisory
• https://t.me/CVEtracker/55010 · Telegram Post
• https://twitter.com/the_yellow_fall/status/2059833036225536270 · Twitter Post
• https://twitter.com/vuldb/status/2059358449809699113 · Twitter Post