IBM EUVD-2025-209027

The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) indicates local attack vector with high complexity, no privilege requirement, and high integrity impact—a mixed signal. The score of 5.1 is moderate, yet the integrity impact is rated high, suggesting the vulnerability can modify or tamper with data or system state. The absence from CISA KEV and the lack of publicly disclosed POC suggest this is not actively exploited in the wild. However, the 'local' attack vector and 'no privilege requirement' are contradictory to the CVE description stating 'privileged user,' indicating potential confusion in scoring or that the vulnerability can be chained with other local access methods. Organizations running IBM Concert should prioritize patching to version 2.2.1 or later, but this is not an emergency-level threat requiring immediate action outside normal patching cycles unless Concert instances handle sensitive orchestration tasks.

An attacker with local system access or a compromised privileged account on the IBM Concert infrastructure could exploit this vulnerability to send unauthorized commands or data through internal communication channels that should be restricted to specific endpoints. Since the attack complexity is high and requires local access, a realistic scenario involves an insider threat or lateral movement following a prior compromise of a lower-privileged system component that shares the same network segment. The attacker could then bypass channel restrictions to manipulate orchestration workflows, access sensitive data, or modify system configuration in ways that would not normally be permitted, even for privileged users.