IBM Concert 1.0.0 through 2.2.0 employs cryptographic algorithms that are weaker than expected, creating a vulnerability that could enable an attacker to decrypt highly sensitive data stored or transmitted by the system. This weakness is classified as CWE‑1240, indicating a flaw in cryptographic material handling that directly compromises confidentiality.

The vulnerability affects IBM Concert Software. Versions 1.0.0 through 2.2.0 are impacted, regardless of deployment type.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of real‑world exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the description does not specify the exact attack vector, it is reasonable to infer that an adversary would need access to encrypted data—through compromised credentials, local/system access, or interception of stored or transmitted information—to leverage this weakness. Administrators should review whether their environment handles sensitive cryptographic material and consider mitigating outcomes accordingly.