CVE-2026-14979 is a medium severity vulnerability in IBM Engineering Lifecycle Management affecting versions 7.0.3 (Interim Fix 001 through 021), 7.1.0 (Interim Fix 001 through 009), and 7.2.0 including Interim Fix 001. The issue arises from improper handling of recursive XML entity references in Document Type Definitions (DTDs), leading to potential denial of service through XML entity expansion attacks. The vulnerability allows a remote attacker to cause service disruption without requiring authentication. No vendor advisory or patch information is currently available to confirm remediation status.

A remote attacker can exploit this vulnerability to cause a denial of service condition in affected IBM Engineering Lifecycle Management installations by triggering excessive XML entity expansion. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting or validating XML input sources to mitigate potential exploitation of XML entity expansion. Monitor IBM's security advisories for updates on patches or official mitigations.