CVE-2026-3603 is an XML External Entity (XXE) injection vulnerability affecting IBM Engineering Lifecycle Management versions 7.0.3 Interim Fix 001 through 7.2.0 Interim Fix 001. The vulnerability arises from improper restriction of XML external entity references during XML data processing. An authenticated attacker could leverage this to access sensitive information or consume system memory resources. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch information is currently available.

Successful exploitation can lead to unauthorized disclosure of sensitive information and partial denial of service through memory resource exhaustion. The attack requires authentication but can be launched remotely over the network. Integrity is not impacted, and availability impact is low. There are no known active exploits reported.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected versions to trusted users only and monitor for suspicious activity related to XML processing. Avoid processing untrusted XML inputs where possible.