CVE-2026-3660 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Authentication Bypass
Unauthenticated attackers can modify server property files to gain unauthorized access to the IBM Engineering Lifecycle Management application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3660?
CVE-2026-3660 is a critical authentication bypass vulnerability in IBM Engineering Lifecycle Management, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.
Weakness: CWE-863
Which versions are affected by CVE-2026-3660?
It affects 1 product.
Products include Ibm Engineering Lifecycle Management.
How do I fix CVE-2026-3660?
No fix has been published for CVE-2026-3660 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-3660 being exploited?
There is no known exploitation of CVE-2026-3660 in the wild and no public exploit code.
Other vulnerabilities in IBM Engineering Lifecycle Management
- CVE-2026-4051 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to Server Post-Auth Remote Code Execution
- CVE-2026-3603 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML external entity injection (XXE) attack
- CVE-2025-36033 IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scripting
- CVE-2026-14979 IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
Sources
Also known as GHSA-cxh9-m8x4-52q5.