IBM Concert EUVD-2026-85362

Requires an authenticated low-privileged account on IBM Concert (versions 1.0.0 through 3.0.0) that can supply input which the application subsequently writes to log files without neutralizing special characters (e.g., CRLF). Exploitation is limited by the authentication requirement (PR:L) and by the narrow impact: the attacker can only tamper with log content (I:L), not read data, execute code, or disrupt availability. No user interaction is needed once authenticated (UI:N). A fix is available from IBM.

This is a low-to-moderate priority issue that does not warrant emergency patching. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) requires an already-authenticated low-privileged user and yields only a limited integrity impact (C:N, I:L, A:N) - no confidentiality loss, no availability impact, no code execution. CWE-117 (improper output neutralization for logs) means the attacker can forge or inject entries into log files, which undermines audit-trail integrity but does not directly compromise the system. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automatable exploitation. The signals are internally consistent: a genuinely low-severity, authenticated, integrity-only weakness rather than a high-CVSS/low-real-risk mismatch. No conflicting data between the CVSS vector and description was found - both point to an authenticated network-facing log-injection flaw.

An authenticated low-privileged IBM Concert user submits input containing CRLF or other special characters that flows unneutralized into an application log file. The attacker forges log entries or splits/injects lines to hide their own activity, frame another user, or plant misleading content that could later mislead operators or downstream log-parsing/SIEM tooling. No public exploit code was identified at time of analysis.