Quick answers
- Is CVE-2026-3660 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-3660 being exploited in the wild.
- How severe is CVE-2026-3660?
- Critical severity, with a CVSS score of 9.8, published 26 May 2026.
- Which products and versions are affected?
- IBM Engineering Lifecycle Management - Jazz Foundation 7.0.3 through iFix021, 7.1.0 through iFix009, 7.2.0 through iFix001.
- Is there a fix for CVE-2026-3660?
- A patch was published on 2026-05-26: Interim fixes released for affected versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-3660 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-3660?
- Check whether you run IBM Engineering Lifecycle Management - Jazz Foundation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authentication bypass vulnerability exists in the Jazz Foundation component of IBM Engineering Lifecycle Management due to incorrect authorization (CWE-863). The flaw allows a remote, unauthenticated attacker to modify server property files. By manipulating these configuration files, an attacker can escalate privileges or bypass authentication mechanisms entirely to gain unauthorized access to the application. The vulnerability is exploitable over the network with low complexity and requires no user interaction. IBM has released interim fixes (iFixes) to address this issue across versions 7.0.3, 7.1.0, and 7.2.0.
Affected products
- IBM Engineering Lifecycle Management - Jazz Foundation 7.0.3 through iFix021, 7.1.0 through iFix009, 7.2.0 through iFix001
Timeline
- 2026-05-26: disclosed
- 2026-05-26: advisory
- 2026-05-26: patched: Interim fixes released for affected versions.