{"id":"CVE-2026-6930","kind":"vulnerability","aliases":["CVE-2026-6930"],"related":[],"title":"IBM Concert: weak cryptography could let attackers decrypt sensitive information","description":"IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.","summary":"IBM Concert versions 1.0 through 3.0.0 use cryptographic algorithms weaker than expected. An attacker who captures the protected data could decrypt highly sensitive information.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-concert","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"- Check the installed IBM Concert version against the affected range `1.0` through `3.0.0`\n- unknown","fix":"- Move IBM Concert to a version newer than `3.0.0` once IBM publishes one\n- unknown","status":"open","published_at":"2026-10-19T17:17:21+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:44:04+00:00","updated_at":"2026-10-25T04:44:04+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-10-25T04:44:04Z","model":"claude-haiku-5-5","output":{"fix":"- Move IBM Concert to a version newer than `3.0.0` once IBM publishes one\n- unknown","reach":"unknown","title":"IBM Concert: weak cryptography could let attackers decrypt sensitive information","impact":"high","summary":"IBM Concert versions 1.0 through 3.0.0 use cryptographic algorithms weaker than expected. An attacker who captures the protected data could decrypt highly sensitive information.","category":"vendor","nicknames":[],"who_cares":["ibm-concert","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker decrypts highly sensitive information protected by weak cryptography","analyst_note":"Check the IBM security bulletin for CVE-2026-6930 for affected components, the fixed version, and the attack prerequisites (NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-6930).","how_to_check":"- Check the installed IBM Concert version against the affected range `1.0` through `3.0.0`\n- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running IBM Concert in the affected version range 1.0 through 3.0.0 are exposed. The sources do not say which deployment or data paths are involved, so exposure beyond the version range is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000581,"input_tokens":3282,"output_tokens":506,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-6930':13A,16A '1.0':27B,50C '3.0.0':29B,52C 'algorithm':32B,58C 'allow':61C 'attack':7A,37B,63C 'captur':39B 'concert':2A,19B,25B,49C 'could':5A,43B,60C 'cryptograph':31B,57C 'cryptographi':4A 'cve':11A,14A 'data':42B 'decrypt':8A,44B,65C 'expect':35B,56C 'high':45B,66C 'host':22B 'ibm':1A,18B,24B,48C 'ibm-concert':17B 'inform':10A,47B,68C 'let':6A 'protect':41B 'self':21B 'self-host':20B 'sensit':9A,46B,67C 'use':30B,53C 'vendor':23B 'version':26B 'weak':3A 'weaker':33B,54C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Concert in the affected version range 1.0 through 3.0.0 are exposed. The sources do not say which deployment or data paths are involved, so exposure beyond the version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-6930","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6930","severity":null,"published_at":"2026-10-19T17:17:21+00:00","modified_at":"2026-10-19T20:55:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}