A flaw in IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 can enable an attacker with administrative privileges to execute arbitrary code on the server due to an exposed method that is not properly restricted. The vulnerability occurs when the application processes requests that invoke this method, allowing the attacker to run code with the elevated privileges of the service account.

IBM Engineering Lifecycle Management – Jazz Foundation is affected for the following product releases: version 7.0.3 through iFix022, version 7.1.0 through iFix010, and version 7.2.0 through iFix002. Users of these releases should verify the presence or absence of the specified interim fixes and plan to apply the recommended patches accordingly.

The CVSS score of 7.2 categorizes this issue as high severity. The EPSS score is not available, so no assessment of exploitation likelihood can be made from that metric, and it is not listed in the CISA KEV catalog. The vulnerability requires that an attacker already possess administrative privileges, indicating an internal threat or post-authentication scenario. Once these conditions are met, remote code execution can be achieved, potentially compromising the entire application environment.