---
id: "CVE-2026-15266"
page: "https://infrastack.ai/live/CVE-2026-15266"
kind: "vulnerability"
aliases: ["CVE-2026-15266"]
title: "IBM Concert: unsafe command execution lets attackers run system commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "IBM Concert Software", "fixed": ["3.1.0"], "affected": ">= 1.0, <= 3.0.1.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm-concert", "other", "self-hosted"]
not_affected_if: []
published_at: "2026-11-08T18:17:02+00:00"
first_seen_at: "2026-11-08T18:22:22+00:00"
updated_at: "2026-11-08T18:23:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15266", "first_seen_at": "2026-11-08T18:22:22+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32", "first_seen_at": "2026-11-08T18:23:26+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32"]}]
exploit_sources: []
---

# IBM Concert: unsafe command execution lets attackers run system commands

Link for people: https://infrastack.ai/live/CVE-2026-15266 (this .md is for agents)

IBM Concert 1.0 through 3.0.1.1 contains components that allow unsafe command execution. An attacker who can reach the affected component can run arbitrary system commands on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Concert Software affected >= 1.0, <= 3.0.1.1 fixed 3.1.0

## How to check

Check your IBM Concert Software version; versions 1.0 through 3.0.1.1 are affected. Upgrade to 3.1.0. IBM lists no workarounds.

## Fix

Upgrade IBM Concert Software to 3.1.0 (download from the Container software library in IBM Entitled Registry, ICR).

## Timeline

- 2026-11-08T18:22:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-15266
- 2026-11-08T18:23:26+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32 — Read IBM bulletin (-32, 29 Oct 2026): affected IBM Concert Software 1.0-3.0.1.1, fix 3.1.0, no workarounds, CVSS 9.8 AV:N/PR:N (IBM). Bulletin gives no component or detail beyond the one-line description. Not in KEV; no PoC checked.

## Documents

- [advisory] IBM Security Bulletin: Multiple Vulnerabilities in IBM Concert Software (3.1.0) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-concert-software-32

## From the sources

IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_