EUVD-2026-104487
GHSA-ppvq-79rq-hjrj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Concert logging endpoint remotely
-
ExploitSubmit input with CRLF/control characters
-
ExecutionUnneutralized data written to log file
-
ImpactForge or corrupt log entries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log output neutralization
|
| Exploitation Conditions | Exploitation requires reaching an IBM Concert (versions 1.0 through 3.0.0) interface or API that accepts attacker-controlled input and writes it to a log file. The concrete prerequisite is that user-supplied data containing special/control characters (such as CRLF or escape sequences) flows into a logging sink without sanitization. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, so a remote unauthorized user can trigger it against affected versions. Limiting factors: impact is confined to integrity of log data (I:L, C:N, A:N) - there is no code execution, data disclosure, or service disruption - so real damage depends on how logs are consumed downstream (e.g., unescaped rendering in a log viewer or trust placed in audit records). |
| Impact | This is a genuinely low-to-moderate priority issue despite being network-reachable. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) indicates a remotely reachable, low-complexity flaw requiring no privileges or user interaction, but with impact limited to integrity-low only (no confidentiality or availability impact), consistent with CWE-117 log injection. No EPSS score, KEV listing, POC, or SSVC data was supplied, so there is no evidence of exploitation pressure - no public exploit identified at time of analysis. The real-world risk is contained: the maximum outcome is forged, corrupted, or misleading log entries rather than code execution or data theft, which primarily degrades forensic/audit integrity and could enable secondary log-based attacks (e.g., poisoning downstream log parsers) only in specific deployments. The 'Authentication Bypass' tag is inconsistent with the actual weakness (CWE-117, improper neutralization of special elements in log output) and appears mislabeled; this is NOT an authentication bypass. Treat as a hygiene/integrity fix rather than an emergency. |
| Exploit ScenarioDerived | A remote attacker submits input containing newline or control characters (e.g., CRLF or terminal escape sequences) to an IBM Concert endpoint that writes the value to a log file without neutralization. The injected content forges fabricated log lines or corrupts log structure, undermining audit trails or potentially exploiting a downstream log viewer. No public exploit code is identified at time of analysis, and the flaw yields only low integrity impact with no code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Log injection in IBM Concert 1.0 through 3.0.0 lets remote unauthenticated attackers corrupt or forge log records by supplying input containing special or control characters that the product writes to its log files without neutralization. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so the only assessed impact is limited integrity damage to log data - there is no code execution, data disclosure, or availability loss. No public exploit code or confirmed active exploitation was identified at time of analysis, and real-world severity depends on how downstream log consumers (viewers, SIEM parsers, audit reviews) handle unescaped content.
RemediationAI
The provided intelligence does not include an exact fixed version, so remediation should begin by consulting IBM's advisory at https://www.ibm.com/support/pages/node/7292374 to identify the release that resolves the log-neutralization defect and upgrading Concert (currently 1.0 through 3.0.0) to that level; patch availability per vendor advisory should be confirmed there rather than assumed. Where an immediate upgrade is not possible, apply compensating controls targeted at the injection path: enforce server-side validation and encoding (strip or escape CR, LF, and ANSI escape sequences) on all fields that reach logging sinks, ideally by moving to structured JSON logging where every value is escaped - the trade-off is development effort and possible changes to existing log-parsing pipelines. Restrict network access to the Concert UI and API to trusted management networks or via a VPN/reverse proxy with authentication in front, which reduces exposure to unauthenticated remote input at the cost of accessibility. Harden downstream consumption by ensuring log viewers and SIEM parsers escape stored content and by forwarding Concert logs to an append-only or integrity-monitored sink, so that forged entries cannot silently alter audit records; operators should also review existing Concert logs for unexpected embedded control characters or fabricated entries, which will not remove the flaw but limits its forensic impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-117, improper neutralization of special elements when data is written to log files - commonly referred to as log injection or log forging. IBM Concert accepts user-controllable values through its web interface or API and passes them into a logging sink without stripping or encoding CR/LF sequences (and potentially terminal escape sequences). Because the CVSS vector specifies PR:N/UI:N, the vulnerable path is reachable by an unauthenticated remote party that can reach the affected endpoint; the only prerequisite is that attacker-supplied content containing these special characters reaches a logging call. Impact stays at I:L because the injected content affects the integrity of log files rather than application state. The practical risk materializes downstream: forged or misleading log entries can pollute audit trails, break line-oriented SIEM or log-parser ingestion, and - where log viewers render stored content without escaping - potentially serve as a secondary injection vector. CPE data was not supplied with this record, so the exact affected build identification should be taken from IBM's advisory (support page node 7292374).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Remote unauthenticated input reaches the logging sink (AV:N/AC:L/PR:N/UI:N); only log integrity is affected (I:L), with no confidentiality or availability impact and no scope change.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB