IBM Concert CVE-2025-36085

Requires an authenticated IBM Concert account (PR:L) with the ability to reach a request-issuing feature; the attacker supplies a target URL/host that the server then fetches on their behalf. Exploitation is limited by the authentication requirement (not exploitable pre-auth) and by the fact that impact is confined to whatever internal services and metadata endpoints are reachable from the Concert server's network position - there is no user interaction requirement and it works against affected default configurations of versions 1.0.0 through 2.0.0 once authenticated.

This is a moderate-severity, authenticated SSRF (CVSS 5.4, CWE-918) whose signals consistently point to LOW real-world priority. The vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) requires an authenticated attacker (PR:L) and yields only low confidentiality and low integrity impact with no availability impact - consistent with the description's framing of 'network enumeration or facilitating other attacks' rather than direct data theft or RCE. EPSS is very low at 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit code is identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' None of the signals conflict: low EPSS, no KEV, no POC, PR:L gating, and constrained impact all align toward a deprioritizable issue. The main caveat is that SSRF is frequently a pivot/chaining primitive, so while direct impact is low, the practical risk depends on the internal network Concert is deployed into (access to cloud metadata endpoints, internal-only services, etc.), which the CVSS base score does not capture. No SSVC/automatable data was provided.

An attacker who already holds a valid low-privilege IBM Concert account submits a crafted request that causes the server to make attacker-controlled outbound requests, using the server as a proxy to probe internal hosts/ports or reach services not exposed externally. No public proof-of-concept is available, and because the flaw requires authentication (PR:L) and yields only low direct impact, realistic value lies in reconnaissance and chaining rather than immediate compromise.