CVE-2026-14979: IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack

Published Jul 14, 2026
·
Updated

DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.

Affected Software

41 affected components
IBM Engineering Lifecycle Management - Jazz Foundation>=7.0.3<=7.0.3 Interim Fix 021, >=7.1.0<=7.1.0 Interim Fix 009, >=7.2.0<=7.2.0 Interim Fix 001
IBM Engineering Lifecycle Management - Jazz Foundation<=7.0.3 (iFix001 through iFix021)
IBM Engineering Lifecycle Management - Jazz Foundation<=7.1.0 (iFix001 through iFix009)
IBM Engineering Lifecycle Management - Jazz Foundation<=7.2.0 and 7.2.0 iFix001
IBM Engineering Lifecycle Management=7.0.3
IBM Engineering Lifecycle Management=7.0.3-ifix001
IBM Engineering Lifecycle Management=7.0.3-ifix002
IBM Engineering Lifecycle Management=7.0.3-ifix003
IBM Engineering Lifecycle Management=7.0.3-ifix004
IBM Engineering Lifecycle Management=7.0.3-ifix005
IBM Engineering Lifecycle Management=7.0.3-ifix006
IBM Engineering Lifecycle Management=7.0.3-ifix007
IBM Engineering Lifecycle Management=7.0.3-ifix008
IBM Engineering Lifecycle Management=7.0.3-ifix009
IBM Engineering Lifecycle Management=7.0.3-ifix010
IBM Engineering Lifecycle Management=7.0.3-ifix011
IBM Engineering Lifecycle Management=7.0.3-ifix012
IBM Engineering Lifecycle Management=7.0.3-ifix013
IBM Engineering Lifecycle Management=7.0.3-ifix014
IBM Engineering Lifecycle Management=7.0.3-ifix015
IBM Engineering Lifecycle Management=7.0.3-ifix016
IBM Engineering Lifecycle Management=7.0.3-ifix017
IBM Engineering Lifecycle Management=7.0.3-ifix018
IBM Engineering Lifecycle Management=7.0.3-ifix018_security_fix
IBM Engineering Lifecycle Management=7.0.3-ifix019
IBM Engineering Lifecycle Management=7.0.3-ifix020
IBM Engineering Lifecycle Management=7.0.3-ifix021
IBM Engineering Lifecycle Management=7.1.0
IBM Engineering Lifecycle Management=7.1.0-ifix001
IBM Engineering Lifecycle Management=7.1.0-ifix0010
IBM Engineering Lifecycle Management=7.1.0-ifix002
IBM Engineering Lifecycle Management=7.1.0-ifix003
IBM Engineering Lifecycle Management=7.1.0-ifix004
IBM Engineering Lifecycle Management=7.1.0-ifix004_security_fix
IBM Engineering Lifecycle Management=7.1.0-ifix005
IBM Engineering Lifecycle Management=7.1.0-ifix006
IBM Engineering Lifecycle Management=7.1.0-ifix007
IBM Engineering Lifecycle Management=7.1.0-ifix008
IBM Engineering Lifecycle Management=7.1.0-ifix009
IBM Engineering Lifecycle Management=7.2.0
IBM Engineering Lifecycle Management=7.2.0-ifix001

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade IBM Engineering Lifecycle Management - Jazz Foundation to a version that resolves this vulnerability.

    Fixed in 7.0.3Patch iFix022
  2. Upgrade

    Upgrade IBM Engineering Lifecycle Management - Jazz Foundation to a version that resolves this vulnerability.

    Fixed in 7.1.0Patch iFix010
  3. Upgrade

    Upgrade IBM Engineering Lifecycle Management - Jazz Foundation to a version that resolves this vulnerability.

    Fixed in 7.2.0Patch iFix002

Event History

Jul 14, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Jul 17, 2026
CVE Published
via MITRE·07:49 PM
Data Sourced
via MITRE·07:49 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-14979?

CVE-2026-14979 has a medium severity rating of 5.3.

2

What does CVE-2026-14979 affect?

CVE-2026-14979 affects IBM Engineering Lifecycle Management - Jazz Foundation, specifically the DOORS component.

3

How can I mitigate the risk of CVE-2026-14979?

To mitigate CVE-2026-14979, apply the latest interim fixes for your version of IBM Engineering Lifecycle Management.

4

What type of attack is associated with CVE-2026-14979?

CVE-2026-14979 is associated with an XML Entity Expansion attack that could lead to a denial of service.

5

Which versions of IBM Engineering Lifecycle Management are impacted by CVE-2026-14979?

The impacted versions include IBM Engineering Lifecycle Management 7.0.3 through 7.2.0 Interim Fix 001.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203