What is the CVSS score of CVE-2025-33088?

CVE-2025-33088 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Concert are affected by CVE-2025-33088?

Concert versions up to 2.1.0 contain a critical permission vulnerability (CVE-2025-33088) that could allow unauthorized access to sensitive resources within affected systems.

How to fix or mitigate CVE-2025-33088?

Within 24 hours: Identify all systems running Concert versions ≤2.1.0 using asset inventory and vulnerability scanning; restrict access to affected Concert instances to trusted networks only. Within 7 days: Evaluate upgrade feasibility to Concert 2.1.1 or later (when available); contact vendor for patch timeline and interim security guidance; implement compensating controls listed below. Within 30 days: Complete migration to patched Concert version or apply vendor-provided hardening configurations; conduct post-remediation access control audit.

Concert CVE-2025-33088

HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-02-17 psirt@us.ibm.com

IBM Concert

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 17, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect file permissions for critical resources.

AnalysisAI

Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).

Technical ContextAI

This vulnerability (CWE-732: Incorrect Permission Assignment for Critical Resource) affects Concert. IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect file permissions for critical resources.

RemediationAI

Monitor vendor advisories for a patch.

More in Concert

View all

CVE-2024-52360 CRITICAL Act Now

9.8 Nov 19

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)

CVE-2024-43177 CRITICAL Act Now

9.8 Oct 22

IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated

CVE-2026-3627 CRITICAL Act Now

9.1 Aug 28

SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem

CVE-2025-33015 HIGH This Week

8.8 Jan 20

Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).

CVE-2024-52359 HIGH This Week

8.8 Nov 19

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions

CVE-2024-55909 MEDIUM This Month

6.5 May 02

IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expan

CVE-2024-55910 MEDIUM This Month

6.5 May 02

IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVS

CVE-2024-51451 MEDIUM This Month

6.5 Feb 04

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to conduct various attacks against the vulne

CVE-2025-33089 MEDIUM This Month

6.5 Feb 17

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized ac

CVE-2025-36018 MEDIUM This Month

6.5 Feb 17

IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an att

CVE-2024-37070 MEDIUM This Month

6.5 Nov 19

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information

CVE-2024-43181 MEDIUM This Month

6.3 Feb 04

IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impe

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all

CVE-2017-9462 HIGH POC

8.8

CVE-2017-3006 HIGH POC

8.8

CVE-2017-9602 CRITICAL POC

9.8

CVE-2022-22960 HIGH POC

7.8

CVE-2021-38085 HIGH POC

7.8

CVE-2021-35449 HIGH POC

7.8

CVE-2020-11855 HIGH POC

7.8

CVE-2020-10883 HIGH POC

7.8

CVE-2025-33088 vulnerability details – vuln.today

Back

Concert CVE-2025-33088

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Concert

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

Share

External POC / Exploit Code