IBM Concert CVE-2026-4413

Exploitation requires the IBM Concert Web UI to be reachable by the attacker's payload and, critically, a victim user to interact with attacker-controlled content (UI:R) - for example clicking a crafted link or loading a page that reflects the injected JavaScript into the Web UI. No authentication is required of the attacker (PR:N), but the attack yields value only when the interacting victim has a trusted/authenticated Concert session, since the stated outcome is credentials disclosure within that session. The key limiting factors are the mandatory user interaction and the need to socially engineer a logged-in user, which constrain this to targeted rather than mass unauthenticated exploitation.

This is a medium-severity reflected/DOM cross-site scripting issue (CVSS 3.1 base 6.1, CWE-79). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N shows a network-reachable, low-complexity flaw requiring no privileges (PR:N) but mandating user interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in the victim's browser context rather than only the vulnerable server. Impact is limited to low confidentiality and low integrity with no availability effect, consistent with session/credential theft rather than direct server compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals are therefore driven entirely by the CVSS vector and description, which do not conflict. The UI:R requirement meaningfully lowers real-world risk versus a fully automatable network attack - a victim must be lured into triggering the payload - so this should be treated as a moderate-priority patch (a vendor fix is available) rather than an emergency, especially given the product's specialized deployment footprint.

An unauthenticated attacker crafts a URL or input containing malicious JavaScript targeting the IBM Concert Web UI and lures an authenticated user into opening it. When the victim loads the page, the script executes within their trusted session and can exfiltrate session tokens or prompt for credentials. No public exploit code was identified in the provided data.