{"id":"CVE-2026-6719","kind":"vulnerability","aliases":["CVE-2026-6719"],"related":[],"title":"IBM Concert: weak cryptography lets attackers decrypt sensitive information","description":"IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.","summary":"IBM Concert versions 1.0 through 3.0.0 use weaker-than-expected cryptographic algorithms. An attacker who captures the protected data can decrypt highly sensitive information.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Concert Software","fixed":["3.0.1.1"],"affected":">= 1.0, <= 3.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["cryptography","ibm-concert","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"Check your IBM Concert Software version (the Concert UI/About page or the deployed container image tag). Anything from 1.0 through 3.0.0 is affected; 3.0.1.1 is fixed.","fix":"Upgrade IBM Concert Software to 3.0.1.1 (download from the Container software library in the IBM Entitled Registry, ICR). IBM lists no workaround.","status":"open","published_at":"2026-10-19T18:17:08+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:22:54+00:00","updated_at":"2026-10-25T03:40:25+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-25T03:22:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM Concert: weak cryptography lets attackers decrypt sensitive information","impact":"high","summary":"IBM Concert versions 1.0 through 3.0.0 use weaker-than-expected cryptographic algorithms. An attacker who captures the protected data can decrypt highly sensitive information.","category":"vendor","nicknames":[],"who_cares":["ibm-concert"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker decrypts highly sensitive information protected by weak cryptography","analyst_note":"Check the IBM security bulletin for CVE-2026-6719 for the fixed version, affected components and whether a patch or configuration change is available.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000497,"input_tokens":3282,"output_tokens":338,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the IBM security bulletin for CVE-2026-6719 for the fixed version, affected components and whether a patch or configuration change is available.","search":"'-2026':11A,14A '-6719':12A,15A '1.0':30B,54C '3.0.0':32B,56C 'algorithm':39B,62C 'allow':65C 'attack':6A,41B,67C 'captur':43B 'concert':2A,17A,22B,28B,53C 'could':64C 'cryptograph':38B,61C 'cryptographi':4A,19B 'cve':10A,13A 'data':46B 'decrypt':7A,48B,69C 'expect':37B,60C 'high':49B,70C 'host':25B 'ibm':1A,16A,21B,27B,52C 'ibm-concert':20B 'inform':9A,51B,72C 'let':5A 'protect':45B 'self':24B 'self-host':23B 'sensit':8A,50B,71C 'software':18A 'use':33B,57C 'vendor':26B 'version':29B 'weak':3A 'weaker':35B,58C 'weaker-than-expect':34B","nicknames":[],"mitigations":[],"who_affected":"Any team running IBM Concert Software, IBM's self-hosted/container-deployed platform, at versions 1.0 through 3.0.0. The flaw is weak randomness (CWE-330) in its cryptography, so someone who can capture protected data could decrypt it; IBM rates it high (7.5, network, no auth). Teams not running Concert can skip it.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:40:25Z","by":"analyst","run_id":765},"products":{"at":"2026-10-25T03:40:25Z","by":"analyst","run_id":765},"workarounds":{"at":"2026-10-25T03:40:25Z","by":"analyst","run_id":765}},"analyst_revisit_at":null,"first_public_at":"2026-10-19T18:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-6719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6719","severity":null,"published_at":"2026-10-19T18:17:08+00:00","modified_at":"2026-10-19T20:55:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-6719:765","url":null,"severity":null,"published_at":"2026-10-25T03:40:25+00:00","modified_at":"2026-10-25T03:40:25+00:00","first_seen_at":"2026-10-25T03:40:25+00:00","fetched_at":"2026-10-25T03:40:25+00:00","note":"IBM bulletin node/7292374 (vendor): Concert Software 1.0-3.0.0 affected, fix = upgrade to 3.0.1.1 via IBM Entitled Registry container library; no workarounds listed. CWE-330, no exploitation or PoC found. Bulletin covers many CVEs; check how_to_check is my own guidance, not vendor text."}],"documents":[{"id":3280,"url":"https://www.ibm.com/support/pages/node/7292374","title":"IBM Security Bulletin: Multiple Vulnerabilities in IBM Concert Software (3.0.1.1)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3282,"url":"https://www.cve.org/CVERecord?id=CVE-2026-6719","title":"CVE Record CVE-2026-6719","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}