PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3027 IBM CVE debrief

CVE-2016-3027 describes an XML External Entity (XXE) issue in IBM Security Access Manager that can lead to denial of service and, in some cases, exposure of sensitive information. NVD rates it Medium severity (CVSS 6.5) and links the issue to IBM Security Access Manager for Web and Mobile firmware versions. IBM PSIRT is cited as the patch/vendor advisory source.

Vendor
IBM
Product
CVE-2016-3027
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM Security Access Manager administrators, IAM/platform owners, and security teams responsible for systems that accept or process XML in the affected IBM firmware lines.

Technical summary

The NVD record maps this issue to CWE-611 (XXE). The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H) indicates network reachability with low attack complexity, but the attacker needs high privileges. Impact is primarily availability loss from memory exhaustion or service disruption, with possible sensitive-data exposure if external entities are resolved during XML processing. The supplied NVD CPEs list affected IBM Security Access Manager for Web 8.0 and 9.0 firmware releases, plus IBM Security Access Manager for Mobile 8.0 firmware releases.

Defensive priority

Medium. Prioritize remediation during the next maintenance cycle, or sooner if affected IBM XML-processing components are reachable by privileged users in production.

Recommended defensive actions

  • Inventory IBM Security Access Manager for Web and Mobile deployments and compare them against the affected firmware versions listed in the NVD record.
  • Apply the IBM PSIRT-referenced fix or patch from the vendor advisory for this CVE.
  • Review XML parser hardening settings and ensure external entity resolution/DTD processing is disabled where supported and appropriate.
  • Restrict administrative and other privileged access paths that can submit XML to the affected component.
  • Monitor for abnormal memory growth, service crashes, and suspicious XML traffic until remediation is complete.

Evidence notes

This debrief is based on the supplied NVD CVE record, which shows vulnStatus=Modified, publishes the CVE on 2017-02-01, and cites IBM support advisory documentation as the patch/vendor reference. The record also lists CWE-611 and specific vulnerable IBM CPEs. No CISA KEV entry was supplied for this CVE.

Official resources

First published in the supplied record on 2017-02-01. The NVD entry was modified on 2026-05-13. No KEV listing was included in the provided data.