IBM Engineering Lifecycle Management versions 7.0.3, 7.1.0, and 7.2.0 contain an incorrect authorization vulnerability (CWE-863) identified as CVE-2026-3660. This flaw allows unauthenticated remote attackers to modify server property files, which could lead to unauthorized access to the application. The vulnerability has a CVSS 3.1 score of 9.8, reflecting its critical nature with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch has been disclosed by IBM at this time.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to update server property files, resulting in unauthorized access to the IBM Engineering Lifecycle Management application. This could compromise the confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild currently, but the critical CVSS score indicates a high risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should restrict network access to the affected IBM Engineering Lifecycle Management instances and monitor for any suspicious activity related to unauthorized configuration changes.