CVE-2026-3660
CRITICALDescription
IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to gain unauthorized access to the application.
Is your site exposed to CVE-2026-3660?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
| ibm | engineering_lifecycle_management |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2026-3660? +
How severe is CVE-2026-3660? +
What products are affected by CVE-2026-3660? +
How do I check if I'm vulnerable to CVE-2026-3660? +
Related Vulnerabilities
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version …
Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to …
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently …
An incorrect authorization vulnerability in MISP allows an organization administrator to target site administrator accounts belonging to the same organization …
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 …
Actual is a local-first personal finance tool. The `POST /openid/config` endpoint in Actual Budget's sync-server versions <= 26.4.0 exposes the …