IBM CONCERT SOFTWARE · CVE-2026-15266 · Other
FIX → 3.1.0 ✓ verified
IBM Concert 1.0 through 3.0.1.1 contains components that allow unsafe command execution. An attacker who can reach the affected component can run arbitrary system commands on the host.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted IBM Concert Software 1.0 through 3.0.1.1. IBM rates it CVSS 9.8 (network, no authentication, no user interaction), so a reachable Concert instance could let an attacker run system commands on the host. IBM does not name the vulnerable component. Teams not running IBM Concert can skip it.
Who cares ibm-concert, self-hosted
3.0.1.1 are affected3.1.0Upgrade to 3.1.0
IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade IBM Concert Software to 3.1.0 (download from the Container software library in IBM Entitled Registry, ICR).