IBM CVE-2025-64647

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network-level attack surface with high attack complexity, no privilege requirement, and high confidentiality impact. The AC:H (high complexity) rating suggests the attacker must overcome significant technical barriers—likely requiring possession of encrypted material and computational resources to perform cryptanalysis or brute-force attacks. The absence of integrity and availability impact limits the vulnerability to passive information disclosure. While CVSS 5.9 sits in the medium range, the real-world risk depends heavily on EPSS score and exploitation maturity, which are not provided in the source data; however, the AC:H factor suggests this is not an easy exploit despite the high confidentiality impact. Organizations should prioritize patching based on whether sensitive data is encrypted with Concert and the exposure of encrypted artifacts to untrusted networks. This is a high-priority patch for institutions handling regulated data (PII, financial, healthcare) but lower urgency for those with strong network segmentation.

An attacker with network access to Concert instances (either internal network access or via compromised credentials) captures encrypted sensitive data such as database connection strings or API keys that are encrypted using Concert's weak cryptographic implementation. Over weeks or months, the attacker performs offline cryptanalysis or brute-force attacks against the weak cipher, eventually recovering the plaintext credentials. These credentials are then used to access backend systems, causing secondary data breaches. The AC:H rating reflects the reality that this attack requires sustained effort and cryptographic knowledge, making it feasible only for determined or sophisticated threat actors rather than commodity malware.