What is the CVSS score of CVE-2025-33088?

CVE-2025-33088 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Concert are affected by CVE-2025-33088?

Concert versions up to 2.1.0 contain a critical permission vulnerability (CVE-2025-33088) that could allow unauthorized access to sensitive resources within affected systems.

How to fix or mitigate CVE-2025-33088?

Within 24 hours: Identify all systems running Concert versions ≤2.1.0 using asset inventory and vulnerability scanning; restrict access to affected Concert instances to trusted networks only. Within 7 days: Evaluate upgrade feasibility to Concert 2.1.1 or later (when available); contact vendor for patch timeline and interim security guidance; implement compensating controls listed below. Within 30 days: Complete migration to patched Concert version or apply vendor-provided hardening configurations; conduct post-remediation access control audit.

Concert CVE-2025-33088

HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-02-17 psirt@us.ibm.com

IBM Concert

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 17, 2026 - 22:18 nvd

HIGH 7.4

DescriptionCVE.org

IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect file permissions for critical resources.

AnalysisAI

Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).

Technical ContextAI

This vulnerability (CWE-732: Incorrect Permission Assignment for Critical Resource) affects Concert. IBM Concert 1.0.0 through 2.1.0 could allow a local user with specific knowledge about the system's architecture to escalate their privileges due to incorrect file permissions for critical resources.

RemediationAI

Monitor vendor advisories for a patch.

More in Concert

View all

CVE-2025-33015 HIGH This Week

8.8 Jan 20

Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).

CVE-2024-55909 MEDIUM This Month

6.5 May 02

IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expan

CVE-2024-55910 MEDIUM This Month

6.5 May 02

IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVS

CVE-2024-51451 MEDIUM This Month

6.5 Feb 04

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to conduct various attacks against the vulne

CVE-2025-33089 MEDIUM This Month

6.5 Feb 17

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized ac

CVE-2025-36018 MEDIUM This Month

6.5 Feb 17

IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an att

CVE-2024-43181 MEDIUM This Month

6.3 Feb 04

IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impe

CVE-2025-36019 MEDIUM This Month

6.1 Feb 17

IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. [CVSS 6.1 MEDIUM]

CVE-2024-55912 MEDIUM This Month

5.9 May 02

IBM Concert Software 1.0.0 through 1.0.5 uses weaker than expected cryptographic algorithms that could allow an attacker

CVE-2025-1722 MEDIUM This Month

5.9 Jan 20

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to a remote attacker to obtain sensitive inf

CVE-2025-1719 MEDIUM This Month

5.9 Jan 20

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to a remote attacker to obtain sensitive inf

CVE-2025-33101 MEDIUM This Month

5.9 Feb 17

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to obtain sensitive information using man in

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

View all

CVE-2025-25373 CRITICAL POC

9.8

CVE-2025-45471 HIGH POC

8.8

CVE-2020-36916 HIGH POC

8.8

CVE-2020-36938 HIGH POC

8.8

CVE-2026-24834 HIGH POC

8.8

CVE-2021-47756 HIGH POC

8.4

CVE-2025-1731 HIGH POC

7.8

CVE-2025-52094 HIGH POC

7.8

CVE-2025-33088 vulnerability details – vuln.today

Back

Concert CVE-2025-33088

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Concert

Same weakness CWE-732 – Incorrect Permission Assignment for Critical Resource

Share

External POC / Exploit Code