CVE-2026-3603 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack
An authenticated attacker can exploit an XML external entity injection vulnerability to expose sensitive information or consume memory resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3603?
CVE-2026-3603 is a high-severity vulnerability in IBM Engineering Lifecycle Management, published on 26 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
IBM Engineering Lifecycle Management 7.0.3 Interim Fix 001 through Interim Fix 021, 7.1.0 Interim Fix 001 through Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
Weakness: CWE-611
Which versions are affected by CVE-2026-3603?
It affects 1 product.
Products include Ibm Engineering Lifecycle Management.
How do I fix CVE-2026-3603?
No fix has been published for CVE-2026-3603 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-3603 being exploited?
There is no known exploitation of CVE-2026-3603 in the wild and no public exploit code.
Other vulnerabilities in IBM Engineering Lifecycle Management
- CVE-2026-3660 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass
- CVE-2026-4051 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution
- CVE-2025-36033 IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting
- CVE-2026-14979 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
Sources
Also known as GHSA-2589-88hx-72gf.