IBM Concert CVE-2026-16426

Exploitation requires access to an IBM Concert instance (versions 1.0.0 through 3.0.0) and, per the description, authenticated access; the attacker must reach a Concert feature that dispatches server-side requests to a user-influenced URL. Impact is bounded to reading/enumerating internal network resources (network enumeration and enabling follow-on attacks), not arbitrary file read or code execution. The primary limiting factors are the need for valid credentials (per description, despite the PR:N in the vendor vector) and Concert's limited enterprise deployment; there is no user-interaction requirement.

This is a moderate-severity SSRF (CWE-918) in IBM Concert, scored 6.5 by the vendor via CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. There is a notable conflict between the CVSS vector and the description: the vector encodes PR:N (unauthenticated), but the description explicitly states 'an authenticated attacker' - verify with vendor, as authentication materially lowers real-world exposure and the vector likely should read PR:L. No EPSS score, KEV listing, POC, or SSVC decision data is provided, so exploitation probability cannot be quantified from the inputs. Impact is limited to C:L/I:L with no availability impact, and the described outcome is network enumeration or facilitating follow-on attacks rather than direct code execution or data theft - this is a chaining/pivot primitive, not a standalone critical. Combined with IBM Concert's niche AIOps footprint and the authentication gate, this is a real but secondary-priority patch item, not an urgent internet-wide threat.

An attacker with valid Concert credentials submits a request through a Concert feature that fetches a user-supplied URL, coercing the server to make requests to internal-only addresses. By observing responses or timing, the attacker enumerates internal hosts and services, then leverages that map to reach otherwise-unexposed internal endpoints. No public exploit code is identified at time of analysis.