EUVD-2026-104528
GHSA-mppm-vxf7-g245
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain encrypted sensitive data
-
ExploitIdentify weak cipher in use
-
ExecutionPerform cryptanalysis / decrypt
-
ImpactRecover highly sensitive plaintext
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Cryptographic random values
|
| Exploitation Conditions | Exploitation requires the attacker to first gain access to data that IBM Concert (1.0-3.0.0) has protected with the weak cryptographic algorithm - for example, captured network traffic or exfiltrated encrypted at-rest data - after which the insufficient algorithm strength allows decryption. No authentication is indicated by the CVSS vector (PR:N), and no user interaction is required (UI:N), but exploitation is inherently limited by the need to possess the ciphertext and to carry out cryptanalytic effort; the impact is confined to confidentiality (I:N/A:N), with no integrity or availability consequence. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, unauthenticated, confidentiality-only weakness in IBM Concert's use of weaker-than-expected cryptographic algorithms (CWE-330). No EPSS score, KEV listing, or POC indicator was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore internally consistent but modest: a HIGH-severity confidentiality issue with no observed exploitation pressure. A notable tension exists between the AC:L rating and the nature of the flaw - exploiting weak cryptography to decrypt 'highly sensitive information' realistically requires the attacker to first obtain the ciphertext (e.g., via intercepted traffic or stored data) and then perform cryptanalysis, which is rarely low-complexity; verify the attack-complexity assumption with IBM. Overall this is a patch-worthy data-protection defect rather than an urgent, mass-exploited priority, and its real-world urgency is further bounded by the limited deployment footprint of IBM Concert. |
| Exploit ScenarioDerived | An attacker who can intercept or otherwise access data encrypted by IBM Concert (versions 1.0 through 3.0.0) leverages the product's use of a weak cryptographic algorithm to recover the plaintext of highly sensitive information without needing valid credentials. No public exploit code is identified, and successful decryption depends on the attacker first obtaining the protected ciphertext. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
IBM Concert versions 1.0 through 3.0.0 rely on weaker-than-expected cryptographic algorithms when protecting sensitive data, allowing an attacker who obtains that ciphertext - captured network traffic or exfiltrated at-rest data - to decrypt highly sensitive information. The weakness is confidentiality-only (C:H/I:N/A:N) with no authentication or user interaction required per the CVSS vector, though practical exploitation demands prior possession of the encrypted material and non-trivial cryptanalytic effort, which is why the independently assessed vector rates complexity as High rather than Low. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM has released a vendor patch.
RemediationAI
Vendor-released patch: IBM has published a fix via support advisory https://www.ibm.com/support/pages/node/7292374 - upgrade IBM Concert from affected releases 1.0 through 3.0.0 to the fixed level specified in that advisory, and rotate or re-encrypt any secrets and sensitive data that were protected with the weak algorithms under the old version, since replacing the software alone does not retroactively strengthen already-encrypted material. In the interim, restrict network exposure of Concert services to trusted segments and enforce strong transport encryption (modern TLS with approved cipher suites) at the perimeter so that captured traffic is not solely dependent on Concert's internal cryptography; the trade-off is added latency and certificate management overhead, and this does not fix at-rest data. Limit access to Concert data stores and backups to the minimum necessary principals, since exploitation requires the attacker to first obtain ciphertext - reducing exfiltration paths directly reduces exposure. Monitor for anomalous access to encrypted stores and unusual decryption or export activity while the upgrade is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-330 (Use of Insufficiently Random Values) is the assigned root-cause class, describing a cryptographic implementation in IBM Concert (CPE cpe:2.3:a:ibm:concert, spanning releases 1.0 through 3.0.0) that falls short of expected algorithm strength - for instance weak key generation, inadequate entropy, or a deprecated cipher or key-length choice. Rather than a direct memory-safety or injection defect, the flaw is a design/implementation weakness in the crypto layer: the data is encrypted, but not strongly enough that determined cryptanalysis (brute force against a reduced keyspace, or known weak-cipher attacks) can be ruled out once the ciphertext is in hand. Because the weakness sits in the confidentiality mechanism itself, every data flow that Concert protects - in transit or at rest - inherits the same exposure, and fixing it typically requires both a software update and re-protection (re-encryption or key rotation) of already-stored data. No integrity or availability impact is indicated by the vector.
Know when Concert gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-exposed and unauthenticated (AV:N/PR:N), but decrypting via weak crypto requires obtaining ciphertext and cryptanalysis (AC:H); confidentiality-only impact (C:H, I/A:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Executive ViewAI
IBM Concert releases 1.0 through 3.0.0 ship with weaker-than-expected cryptography protecting sensitive data, meaning any encrypted material an adversary already holds - captured traffic or stolen data at rest - could be decrypted back into readable form. Because exploitation requires prior possession of the ciphertext plus substantial cryptanalytic effort, this is a data-confidentiality exposure rather than an intrusion path, but it undermines the assumption that encryption alone protects Concert-stored information. Leadership should care because the affected platform typically holds sensitive operational and asset data whose disclosure carries regulatory and reputational consequences.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
Local code execution in IBM Concert 1.0.0 through 2.1.0 allows an authenticated attacker to overflow a stack buffer and
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
Exploit-DB