IBM Concert EUVD-2026-86009

Exploitation requires local access to a host running IBM Concert 1.0.0 through 3.0.0 and depends on the recursive directory-copy operation actually sweeping in sensitive files - the impact is contingent on secrets, credentials, or otherwise protected data existing within the copied directory trees. There is no remote exploitation path (AV:L) and no privileges or user interaction are modeled (PR:N/UI:N), but the local-only vector inherently limits exposure to actors who already have a foothold on the system. The severity is bounded to confidentiality/information disclosure and increased attack surface; there is no integrity or availability impact.

This is a moderate, low-priority hygiene/design flaw rather than a directly weaponizable vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 6.2) describes a LOCAL attack vector with no privileges and no user interaction, yielding high confidentiality impact and no integrity or availability impact - consistent with CWE-552 (Files or Directories Accessible to External Parties) where a recursive directory copy sweeps in secrets or sensitive artifacts that then become locally readable, enlarging the attack surface. Signals are notably sparse: no EPSS score, no CISA KEV listing, and no public exploit are present in the input, so there is no public exploit identified at time of analysis. The C:H rating is arguably aggressive for what is fundamentally a packaging/copy-control weakness - actual impact depends entirely on whether sensitive material (credentials, keys, config) is present in the copied trees. Because the vector is local (AV:L), exploitation requires the actor to already have some presence on the host, which sharply limits real-world risk despite the 'high' confidentiality metric. Net: real but low-urgency; patch during normal maintenance.

IBM Concert copies a directory tree recursively during an operation (e.g., packaging, backup, or deployment) and, lacking proper controls, pulls in sensitive files (secrets, credentials, or unnecessary config) into a location where a local user or lower-privileged process can read them. A local actor with access to the host then reads those unintentionally-included sensitive files, harvesting information that should not have been exposed. No public exploit code is available and no active exploitation is reported.