A flaw in the Jazz Foundation component of IBM Engineering Lifecycle Management permits end‑users with administrative privileges to execute arbitrary code on the server because a method is exposed without adequate access checks. The vulnerability arises when the application processes requests that allow direct invocation of this method, enabling an attacker to run arbitrary code with the elevated privileges of the service account.

IBM Engineering Lifecycle Management – Jazz Foundation is affected for the following product releases: version 7.0.3 through Interim Fix 021, version 7.1.0 through Interim Fix 009, and version 7.2.0 through Interim Fix 001. Users of these releases should verify the presence or absence of the specified interim fixes and plan to apply the recommended patches accordingly.

The CVSS score of 7.2 categorizes this issue as high severity. The EPSS score is not available, so no assessment of exploitation likelihood can be made from that metric, and it is not listed in the CISA KEV catalog. The vulnerability requires that an attacker already possess administrative privileges, indicating an internal threat or post‑authentication scenario. Once these conditions are met, remote code execution can be achieved, potentially compromising the entire application environment.