CVE-2026-4051: IBM Engineering Lifecycle Management RCE in Jazz Foundation

CVE-2026-4051 · Severity: high · CVSS 7.2 · Published 2026-05-26

IBM Engineering Lifecycle Management, a suite of tools used by organizations to manage the software development lifecycle, is vulnerable to a security flaw that could allow an administrator to execute unauthorized commands on the server. While the attack requires high-level administrative privileges, a successful exploit could lead to a full system takeover, data theft, or disruption of the development environment. Organizations should apply the latest interim fixes to secure their installations.

Technologies: IBM Engineering Lifecycle Management - Jazz Foundation. Vendors: IBM.

Quick answers

Is CVE-2026-4051 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-4051 being exploited in the wild.
How severe is CVE-2026-4051?
High severity, with a CVSS score of 7.2, published 26 May 2026.
Which products and versions are affected?
IBM Engineering Lifecycle Management - Jazz Foundation 7.0.3 through iFix021, 7.1.0 through iFix009, 7.2.0 through iFix001.
Is there a fix for CVE-2026-4051?
A patch was published on 2026-05-26. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4051 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-4051?
Check whether you run IBM Engineering Lifecycle Management - Jazz Foundation at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote code execution (RCE) vulnerability exists in the Jazz Foundation component of IBM Engineering Lifecycle Management. The flaw is categorized as CWE-749 (Exposed Dangerous Method or Function), where a specific method is accessible over the network without sufficient access control restrictions. An attacker with administrative privileges can invoke this method to execute arbitrary code on the underlying server. The vulnerability affects versions 7.0.3, 7.1.0, and 7.2.0. IBM has released remediation in the form of Interim Fixes (iFix022 for 7.0.3, iFix010 for 7.1.0, and iFix002 for 7.2.0).

Affected products

  • IBM Engineering Lifecycle Management - Jazz Foundation 7.0.3 through iFix021, 7.1.0 through iFix009, 7.2.0 through iFix001

Timeline

  • 2026-05-26: disclosed
  • 2026-05-26: advisory
  • 2026-05-26: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.