What is the CVSS score of CVE-2025-64649?

CVE-2025-64649 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-64649?

Yes, a patch is available for CVE-2025-64649. Update the affected software to the latest version immediately.

IBM Concert CVE-2025-64649

EUVD-2025-210810 MEDIUM

Improper Certificate Validation (CWE-295)

2026-08-28 ibm

GHSA-wwwh-vhpv-hrmp

Authentication Bypass IBM Concert

5.9

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.4 HIGH

MitM via certificate bypass inherently exposes both confidentiality and integrity of intercepted traffic; AC:H reflects mandatory network positioning prerequisite.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 22:41 vuln.today

DescriptionNVD

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.

AnalysisAI

IBM Concert versions 1.0.0 through 2.3.1 expose deployments to man-in-the-middle attacks due to improper TLS certificate validation (CWE-295), enabling remote attackers to intercept and manipulate communications between Concert components. The integrity impact is rated High by IBM's own CVSS scoring, meaning an adversary successfully positioned in the network path can perform unauthorized actions against affected Concert instances. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7285337.

Technical ContextAI

CWE-295 (Improper Certificate Validation) describes a failure to adequately verify the authenticity of TLS/SSL certificates presented during connection establishment, allowing an attacker to substitute a forged or attacker-controlled certificate. IBM Concert (CPE: cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*), IBM's AI-powered IT operations management platform introduced in the 1.x era and actively developed through 2.3.1, relies on network communication between its components and external integrations. When certificate validation is skipped or insufficiently enforced, any encrypted channel becomes transparent to an adversary with the appropriate network vantage point. The affected version range spans 1.0.0 through 2.3.1, suggesting the flaw was present since initial release.

RemediationAI

IBM has released a patch addressing this vulnerability; the vendor advisory at https://www.ibm.com/support/pages/node/7285337 should be consulted for the specific fix version and upgrade instructions, as no exact patched version number was included in the available intelligence. Until patching is completed, organizations should restrict network paths to IBM Concert components to trusted, segmented network segments to reduce the feasibility of MitM positioning - for example, placing Concert behind an internal firewall and ensuring inter-component traffic does not traverse untrusted network hops. Enabling strict mutual TLS (mTLS) at the infrastructure layer (load balancer or service mesh) where Concert endpoints communicate can serve as a compensating control, though this does not resolve the underlying application-level validation flaw. Monitoring for anomalous ARP or BGP behavior on Concert-adjacent network segments can support early detection of MitM attempts.