Advisory · CVE-2026-6715
IBM Concert turns crafted input into operating system commands
IBM Concert 1.0 through 3.0.1.1 allows an attacker to supply crafted input that is incorporated into an operating system command without adequate validation or sanitization, letting remote attackers execute arbitrary commands on the underlying operating system with the privileges of the affected service, rated critical at CVSS 9.8.
- Vendor
- IBM
- Product
- Concert
- Identifier / CWE
- CVE-2026-6715
CWE-78 - Action timing
- Immediate
Explain it like I’m five
IBM Concert builds operating system commands using words the attacker supplies, without cleaning them first. A crafted word becomes a command of the attacker's choosing, run with the service's own privileges.
- 01Crafted input supplied
A remote attacker sends input to Concert.
- 02Input incorporated
The input is built into an operating system command without adequate validation.
- 03Command runs
Arbitrary commands execute with the privileges of the affected service.
What happened
IBM Concert 1.0 through 3.0.1.1 allows an attacker to supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service. The record rates it critical at CVSS 9.8 under version 3.1, with network attack vector, low complexity, no privileges required, and no user interaction.
This shares IBM’s bulletin with a sibling command execution flaw in the same Concert versions, and both are unauthenticated. IBM’s bulletin lists the affected versions and the fix.
What to do
- Inventory Concert deployments and record each version.
- Check the IBM bulletin for the fix and apply it.
- Review host and application logs for unexpected command execution.
- Treat the host as potentially compromised if exploitation cannot be excluded.
- Verify the deployed version after updating.
Management note
Two unauthenticated command execution flaws in one product and one bulletin. Patch Concert before anything else in this batch.