EUVD-2026-67959
GHSA-84wv-8jqp-6jhr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed IBM Concert endpoint
-
DeliverySubmit crafted SQL in request parameter
-
ExploitBypass query parsing via injection
-
ExecutionExecute attacker-controlled SQL on back-end DB
-
ImpactExfiltrate or alter database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of IBM Concert (versions 1.0.0 through 2.3.1), per the CVSS vector AV:N/AC:L/PR:N/UI:N. The only practical limiting factor is network reachability to the Concert application and running an in-range version; there is no authentication, privilege, user-interaction, or non-default-configuration requirement documented in the source data, so any exposed instance in the affected version band is at risk. |
| Impact | Signals are mostly consistent toward high priority: the CVSS 3.1 base score of 9.1 reflects an unauthenticated, network-facing, low-complexity vector with high confidentiality and integrity impact, which is the classic profile of an easily weaponized SQLi. However, some signals are missing or soften the picture: there is no EPSS probability provided, no KEV listing, and no public POC, so this is currently a serious-but-not-actively-exploited issue rather than a confirmed mass-exploitation event. Availability is rated N despite the description explicitly mentioning the ability to 'delete information,' a mild internal inconsistency - deletion arguably has an availability dimension, but the base vector treats it as integrity impact only. The real-world urgency is elevated by the trivial exploitation prerequisites (PR:N/AC:L) even though the product's deployment footprint is comparatively narrow. |
| Exploit ScenarioDerived | A remote attacker with network reachability to the IBM Concert application submits a request containing a crafted SQL payload in a vulnerable parameter; because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), the injected statement executes against the back-end database, letting the attacker dump sensitive records or tamper with stored data. No public exploit is identified at time of analysis, but the trivial prerequisites make custom exploit development straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statements and read, insert, modify, or delete arbitrary data in the back-end database. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication or user interaction, yielding high confidentiality and integrity impact. A vendor patch is available; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
RemediationAI
Apply the fix referenced in IBM's advisory: Patch available per vendor advisory at https://www.ibm.com/support/pages/node/7285337 - upgrade IBM Concert to the IBM-designated fixed release above 2.3.1 (consult the advisory for the exact patched version, which is not restated in the source data, so do not rely on an invented number). If patching cannot be performed immediately, restrict network access to the Concert application to trusted management networks or place it behind a WAF with SQL-injection signatures tuned to the affected endpoints (trade-off: WAF rules can be bypassed by novel payloads and may cause false positives), and monitor database and application logs for anomalous query patterns or errors. Avoid exposing the Concert interface to the public internet until the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Concert is an IBM enterprise operations/application-management platform that relies on a relational back-end database. The flaw is a classic SQL injection (CWE-89 class, though the CWE was not populated in the source data): user-supplied input is concatenated into SQL queries without adequate parameterization or sanitization, letting an attacker alter query structure. Per the single CPE string cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:* the affected component is the IBM Concert application itself across all editions of the impacted version band, and the vendor (IBM) is the reporting source.
Know when Concert gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network SQLi with low complexity (PR:N/AC:L/AV:N); full data read and write give C:H/I:H, with A:N as the base treats deletion as integrity rather than availability.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Concert 1.0.0 through 2.3.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
Executive ViewAI
IBM Concert versions 1.0.0 through 2.3.1 contain a critical SQL injection vulnerability allowing unauthenticated remote attackers to read, modify, and delete database contents without restrictions. Organizations using Concert face immediate risk of data breach and unauthorized modification of critical business data. A vendor patch is available and must be deployed without delay to eliminate this exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
Local code execution in IBM Concert 1.0.0 through 2.1.0 allows an authenticated attacker to overflow a stack buffer and
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
IBM Concert 1.0.0 through 2.1.0 can disclose residual heap memory contents to remote, unauthenticated users because serv
Exploit-DB