CVE-2026-6715 · Vendor
NO FIX YET · SEE WHAT TO DO
IBM Concert versions 1.0 through 3.0.1.1 pass attacker-supplied input into operating system commands without proper validation. A remote attacker can run arbitrary commands on the server with the privileges of the affected service.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
IBM Concert deployments in the affected version range are exposed to remote command injection. The sources do not describe which configurations or interfaces are reachable, so whether a given instance is exposed is unknown.
Who cares ibm-concert, self-hosted
1.0 through 3.0.1.1IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.