EUVD-2026-85670
GHSA-x46m-wmgm-cfvg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector and a low-privileged account are required to manipulate the search path (AV:L/PR:L); resulting code execution in the Concert context yields full C/I/A impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.
AnalysisAI
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged account on the host execute arbitrary code by manipulating the search path used when Concert spawns operating system commands. Because Concert does not fully qualify the executable paths it invokes, a malicious binary placed earlier in the search order is executed with the privileges of the Concert process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires local system access to a host running IBM Concert 1.0.0 through 3.0.0 and the ability to influence the process search path - e.g., write access to a directory that precedes the legitimate binary location in PATH, or control over the PATH environment variable seen by the Concert process. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) is internally consistent with the description: this is a local privilege-escalation / code-execution flaw (CWE-427, uncontrolled search path element), not a remotely reachable one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch availability is confirmed by IBM - the advisory at https://www.ibm.com/support/pages/node/7288830 provides the fixed builds, but no exact fix version is stated in the available data, so upgrade to the patched release named in that advisory rather than assuming a version number. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every host running IBM Concert and confirm which are on versions 1.0.0 through 3.0.0, restrict interactive and service local accounts on those hosts to the minimum necessary, and review audit logs for unusual child process execution or binaries written to directories earlier in the system search path. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).
An authenticated remote user of IBM Concert versions 1.0.0 through 3.0.0 can degrade or deny service availability by dri
Same weakness CWE-427 – Uncontrolled Search Path Element
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today