CVE-2026-3660
Unauthenticated File Update in IBM Engineering Lifecycle Management
Publication date: 2026-05-26
Last updated on: 2026-05-26
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | engineering_lifecycle_management | to 7.0.3 (inc) |
| ibm | engineering_lifecycle_management | to 7.1.0 (inc) |
| ibm | engineering_lifecycle_management | to 7.2.0 (inc) |
| ibm | engineering_lifecycle_management | to 7.0.3 (exc) |
| ibm | engineering_lifecycle_management | to 7.1.0 (exc) |
| ibm | engineering_lifecycle_management | to 7.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
IBM Engineering Lifecycle Management - Jazz Foundation has an authentication bypass vulnerability identified as CVE-2026-3660.
This flaw allows an unauthenticated remote attacker to update server property files, which can lead to unauthorized access to the application.
The vulnerability is classified under CWE-863 (Incorrect Authorization) and affects versions 7.0.3 (through Interim Fix 021), 7.1.0 (through Interim Fix 009), and 7.2.0 (through Interim Fix 001).
How can this vulnerability impact me? :
An unauthenticated remote attacker could exploit this vulnerability to update server property files, which may allow them to gain unauthorized access to the IBM Engineering Lifecycle Management application.
This unauthorized access could lead to a complete compromise of confidentiality, integrity, and availability of the affected system, as indicated by the CVSS score of 9.8 with high impact on all three security aspects.
What immediate steps should I take to mitigate this vulnerability?
IBM recommends upgrading to specific Interim Fixes (iFixes) to remediate the issue.
- For version 7.0.3, apply iFix022.
- For version 7.1.0, apply iFix010.
- For version 7.2.0, apply iFix002.
No workarounds are provided, so customers are advised to apply these fixes promptly.