IBM Concert
CVE-2025-36150
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to encrypted Concert data
-
ExploitIdentify weak cryptographic algorithm
-
ExecutionPerform cryptanalysis/brute-force decryption
-
ImpactRecover sensitive plaintext
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Approved algorithm selection
|
| Exploitation Conditions | Exploitation requires that the attacker already possess data encrypted by IBM Concert 1.0.0 through 2.0.0 - obtained via on-path network interception, access to encrypted data at rest, or a prior compromise - after which the weaker-than-expected cryptographic algorithm (CWE-327) permits decryption of that ciphertext. The limiting factor is this ciphertext-acquisition prerequisite: the flaw does not itself grant access to data but weakens its protection, so an attacker cannot exploit it purely remotely against a default deployment without first intercepting or accessing the protected material. Impact is confined to confidentiality (I:N/A:N); no code execution or data modification results. |
| Impact | All signals point to a low-priority, low-real-risk issue despite the 7.5 'High' CVSS base score. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) scores confidentiality-only with no integrity or availability impact, and the 7.5 is driven almost entirely by the C:H rating applied to 'highly sensitive information.' EPSS is effectively floor-level at 0.02% (6th percentile), indicating virtually no observed or predicted exploitation activity. There is no CISA KEV listing and no public PoC, so exploitation status is 'no public exploit identified at time of analysis.' A key caveat: the vendor's AC:L is optimistic for a CWE-327 weak-cryptography flaw - decrypting protected data almost always requires the attacker to FIRST obtain the ciphertext (on-path capture, access to stored encrypted data, or a prior breach), which is an unstated precondition that realistically raises attack complexity. The description does not name the weak algorithm, the data classification, or how an attacker reaches the ciphertext, so the true exploitability is lower than the network/no-auth vector implies. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker who has already captured encrypted data from IBM Concert (for example via network interception or access to encrypted stored data) exploits the use of a weak/outdated cryptographic algorithm to decrypt it offline and recover highly sensitive information. No public exploit code exists, and success depends on the attacker first possessing the ciphertext, so this is an opportunistic confidentiality compromise rather than a remote takeover. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 30, 2026
IBM Concert 1.0.0 through 2.0.0 relies on weaker-than-expected cryptographic algorithms, permitting an attacker who already possesses data encrypted by the product to recover highly sensitive plaintext. Exploitation cannot be initiated by a remote network request against a default deployment: the attacker must first obtain the protected ciphertext through on-path interception, access to encrypted data at rest, or a prior compromise, which makes the vulnerability a weakness-amplifier rather than a standalone entry point. The CVSS base score is 7.5 (High) with a network vector, but the independent assessment raises attack complexity to High and the EPSS score is 0.02% (6th percentile), with no public exploit code and no CISA KEV listing - indicating a low-priority, low-real-risk issue in practice. Impact is limited to confidentiality.
Earlier versions of this analysis (1)
IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
RemediationAI
No fixed version is specified in the supplied data, so administrators should consult the IBM advisory at https://www.ibm.com/support/pages/node/7252019 to confirm whether a patched Concert release exists and to obtain the exact upgrade target before making changes; if a fix has been published, upgrade to that release and re-encrypt affected data with the corrected implementation. Because the weakness can only be exercised against ciphertext the attacker already holds, the most effective compensating controls target ciphertext acquisition rather than the algorithm itself: enforce strong TLS with modern cipher suites and certificate pinning on all Concert traffic to blunt on-path interception; encrypt data at rest with a full-disk or application-layer solution that does not depend on Concert's own weak crypto, accepting the added key-management overhead and performance cost; and tighten access controls and auditing on Concert data stores and backups so that a moderate compromise cannot yield the encrypted material. Key and credential rotation limits the value of previously intercepted ciphertext but does not repair the underlying weakness, and blocking network access to Concert interfaces is impractical for the product's normal operation, so these measures should be treated as risk reduction until a vendor fix is confirmed and applied.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-327, Use of a Broken or Risky Cryptographic Algorithm. IBM Concert is a risk and compliance management offering that stores and processes sensitive organizational data whose protection depends on the strength of its cryptographic implementation; the advisory indicates that the algorithms used fall short of expected strength, reducing the work factor required to defeat that protection. The affected CPE string cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:* is wildcarded on version, so the advisory rather than the CPE is the authoritative source of the 1.0.0 through 2.0.0 range. Because the weakness affects the cryptographic layer protecting data rather than an input-validation or memory-safety path, there is no code-execution or data-modification primitive: the assessed impact is confined to confidentiality (C:H, I:N, A:N). The assessed vector differs from the published one by scoring AC:H instead of AC:L, reflecting the prerequisite that ciphertext must already be in the attacker's possession before the weak algorithm can be leveraged. The IBM advisory does not, in the supplied data, name the specific algorithm, key length, or mode involved, so the exact cryptographic deficiency should be confirmed against the vendor notice.
Know when Concert gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weak crypto requires the attacker to first capture ciphertext and perform cryptanalysis, so AC:H rather than vendor's AC:L; confidentiality-only impact (C:H, I:N, A:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Executive ViewAI
IBM Concert versions 1.0.0 through 2.0.0 use weaker-than-expected cryptographic algorithms, which means that any encrypted IBM Concert data an adversary already holds could be decrypted to expose highly sensitive plaintext. The exposure is not a standalone entry point: an attacker must first obtain the ciphertext through network interception, access to encrypted data at rest, or a separate compromise, so the practical risk to the organization is a secondary one that amplifies the consequences of an existing incident rather than creating a new one. Leadership should care because the affected data is classified as highly sensitive and confidentiality is the sole impacted pillar, meaning any prior or future data-handling gap involving Concert could escalate into a disclosure event.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and monitor all access to IBM Concert-encrypted data at rest and in transit; enforce strong transport protections (TLS, network segmentation, egress filtering) on paths carrying Concert ciphertext; re-encrypt or rotate keys for stored Concert data using a stronger algorithm where supported; assume any previously intercepted or exfiltrated Concert ciphertext is at risk and include it in incident scoping; and pursue vendor guidance and upgrade options through IBM support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
Local code execution in IBM Concert 1.0.0 through 2.1.0 allows an authenticated attacker to overflow a stack buffer and
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
GitHub PoC
Exploit-DB