EUVD-2026-85658
GHSA-j9v6-hchx-c83p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access to Concert host
-
ExploitLocate world/group-writable application files
-
ExecutionModify or replace application files
-
ImpactTamper with application integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires LOCAL access to the host running IBM Concert 1.0.0 through 3.0.0 (AV:L) - the flaw is improper access control (CWE-276) on application files, allowing a local principal to modify files they should not be permitted to write. Limiting factors: the attacker must already be present on the server (no network vector); impact is integrity-only (no data disclosure or denial of service); and the product is a niche, recently released IBM enterprise platform with limited deployment. Although IBM rates privileges as PR:N, local access in practice typically requires at least a local account or a compromised co-resident process. |
| Impact | This is a genuine integrity risk but not a top-priority emergency. The CVSS vector (AV:L/AC:L/PR:N/UI:N, base 6.2) describes a LOCAL attack surface - the attacker must already have a foothold on the host running IBM Concert - with impact limited to integrity (C:N/I:H/A:N): unauthorized modification of application files. This aligns with CWE-276 (incorrect/permissive file permissions), where the 'improper access control' is on-disk rather than network-reachable. No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active or widespread exploitation - this is a vendor (IBM) self-reported issue with a patch already available. Note a tension worth flagging: IBM assigns PR:N (no privileges), yet AV:L requires local access, which in practice presupposes some local account or shell; the 'unauthorized modification' language suggests a user who should not have write access can obtain it, so PR:N reads optimistically - verify with IBM whether truly any local principal (including unauthenticated ones) can trigger it. Overall: real but low-urgency, gated behind local access to a niche enterprise product, with a patch available. |
| Exploit ScenarioDerived | A local user or a low-privileged process on the server hosting IBM Concert (versions 1.0.0-3.0.0) leverages overly permissive file/directory permissions to write to or replace application files they should not be able to touch. By tampering with these files, the attacker can corrupt or backdoor the application's behavior; no public exploit code has been identified at time of analysis, and the attack requires pre-existing local access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Improper access control in IBM Concert 1.0.0 through 3.0.0 lets a local attacker who already has access to the host modify application files that should be protected, yielding an integrity-only impact with no data disclosure or denial of service. The vendor CVSS vector is 6.2 with AV:L/PR:N, while the independent assessment rates PR:L because exploiting this flaw in practice typically requires at least a local account or a compromised co-resident process; IBM has released a vendor patch. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied. This is a genuine integrity risk but not a top-priority emergency, given the local attack vector and the product's limited deployment.
RemediationAI
Apply the vendor-supplied fix for IBM Concert as described in IBM's support page (https://www.ibm.com/support/pages/node/7288830); the input does not specify an exact patched version, so treat the advisory as the authoritative source and update to the latest available release or interim fix. If immediate patching is not possible, restrict local interactive access to the Concert host to trusted administrators only, and harden file system permissions on Concert application directories so that only the service account and root/administrator can write to them-this may break automated update or installation processes, requiring manual maintenance. Additionally, enable file-integrity monitoring on those directories to detect unauthorized modification, accepting the trade-off of added alert volume and tuning overhead, and isolate the host from untrusted local users or co-resident workloads to reduce the attack surface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-276 (Incorrect Default Permissions) is the root-cause class: the IBM Concert installation leaves application files writable by principals that should not have write access. Because the vector is AV:L, an attacker must first obtain code execution or an interactive session on the host running Concert; the flaw then allows tampering with application files-potentially configuration, scripts, or libraries-to alter behavior, but with no direct confidentiality or availability impact per the assessed CVSS (C:N/I:H/A:N). CPE cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:* confirms all versions from 1.0.0 through 3.0.0 are in scope. The vendor vector lists PR:N, whereas the independent assessment uses PR:L, reflecting that local access normally requires some existing local foothold; this discrepancy does not change the local-only, integrity-focused nature of the issue.
Know when Concert gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Local file-permission flaw needs a local foothold (AV:L) and realistically a local account (PR:L over IBM's PR:N); impact is integrity-only via file modification (I:H, C:N/A:N).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
Local code execution in IBM Concert 1.0.0 through 2.1.0 allows an authenticated attacker to overflow a stack buffer and
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
Exploit-DB