{"id":"CVE-2026-15266","kind":"vulnerability","aliases":["CVE-2026-15266"],"related":[],"title":"IBM Concert: unsafe command execution lets attackers run system commands","description":"IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.","summary":"IBM Concert 1.0 through 3.0.1.1 contains components that allow unsafe command execution. An attacker who can reach the affected component can run arbitrary system commands on the host.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Concert Software","fixed":["3.1.0"],"affected":">= 1.0, <= 3.0.1.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm-concert","other","self-hosted"],"not_affected_if":[],"how_to_check":"Check your IBM Concert Software version; versions 1.0 through 3.0.1.1 are affected. Upgrade to 3.1.0. IBM lists no workarounds.","fix":"Upgrade IBM Concert Software to 3.1.0 (download from the Container software library in IBM Entitled Registry, ICR).","status":"open","published_at":"2026-11-08T18:17:02+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:22:36+00:00","updated_at":"2026-11-08T18:23:26+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-08T18:22:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM Concert: unsafe command execution lets attackers run system commands","impact":"high","summary":"IBM Concert 1.0 through 3.0.1.1 contains components that allow unsafe command execution. An attacker who can reach the affected component can run arbitrary system commands on the host.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ibm-concert","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs arbitrary system commands on the host","analyst_note":"Find the IBM security bulletin for CVE-2026-15266 to confirm the fixed version, the reachable component and the authentication requirement.","how_to_check":"- Check whether IBM Concert is installed and note its version against the affected range `1.0` through `3.0.1.1`\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000655,"input_tokens":4516,"output_tokens":407,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the IBM security bulletin for CVE-2026-15266 to confirm the fixed version, the reachable component and the authentication requirement.","search":"'-15266':13A,16A '-2026':12A,15A '1.0':29B,57C '3.0.1.1':31B,59C 'affect':45B 'allow':35B,63C 'arbitrari':49B,74C 'attack':7A,40B 'command':4A,10A,37B,51B,66C,76C 'compon':33B,46B,61C 'concert':2A,18A,22B,28B,56C 'contain':32B,60C 'could':69C 'cve':11A,14A 'execut':5A,38B,67C 'exploit':71C 'host':26B,54B,79C 'ibm':1A,17A,21B,27B,55C 'ibm-concert':20B 'let':6A 'potenti':64C 'reach':43B 'run':8A,48B,73C 'self':25B 'self-host':24B 'software':19A 'system':9A,50B,75C 'unsaf':3A,36B,65C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted IBM Concert Software 1.0 through 3.0.1.1. IBM rates it CVSS 9.8 (network, no authentication, no user interaction), so a reachable Concert instance could let an attacker run system commands on the host. IBM does not name the vulnerable component. Teams not running IBM Concert can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T18:23:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32","run_id":2211},"products":{"at":"2026-11-08T18:23:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32","run_id":2211},"workarounds":{"at":"2026-11-08T18:23:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32","run_id":2211},"how_to_check":{"at":"2026-11-08T18:23:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32","run_id":2211},"who_affected":{"at":"2026-11-08T18:23:26Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32","run_id":2211}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["concertsoftware","ibmconcertsoftware"],"ptokens":["concert","ibm","software"],"labels":["critical","ibmconcert","other","selfhosted"],"campaign_type":null,"search_a":"'-15266':13A,16A '-2026':12A,15A 'attack':7A 'command':4A,10A 'concert':2A,18A 'cve':11A,14A 'execut':5A 'ibm':1A,17A 'let':6A 'run':8A 'software':19A 'system':9A 'unsaf':3A","search_b":"'1.0':29B '3.0.1.1':31B 'affect':45B 'allow':35B 'arbitrari':49B 'attack':40B 'command':37B,51B 'compon':33B,46B 'concert':22B,28B 'contain':32B 'execut':38B 'host':26B,54B 'ibm':21B,27B 'ibm-concert':20B 'reach':43B 'run':48B 'self':25B 'self-host':24B 'system':50B 'unsaf':36B","search_c":"'1.0':57C '3.0.1.1':59C 'allow':63C 'arbitrari':74C 'command':66C,76C 'compon':61C 'concert':56C 'contain':60C 'could':69C 'execut':67C 'exploit':71C 'host':79C 'ibm':55C 'potenti':64C 'run':73C 'system':75C 'unsaf':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-15266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15266","severity":null,"published_at":"2026-11-08T18:17:02+00:00","modified_at":"2026-11-08T18:17:02+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-15266:2211","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32","severity":null,"published_at":"2026-11-08T18:23:26+00:00","modified_at":"2026-11-08T18:23:26+00:00","first_seen_at":"2026-11-08T18:23:26+00:00","fetched_at":"2026-11-08T18:23:26+00:00","note":"Read IBM bulletin (-32, 29 Oct 2026): affected IBM Concert Software 1.0-3.0.1.1, fix 3.1.0, no workarounds, CVSS 9.8 AV:N/PR:N (IBM). Bulletin gives no component or detail beyond the one-line description. Not in KEV; no PoC checked.","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32"]}],"documents":[{"id":102927,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM Concert Software (3.1.0)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}