Description
IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.
Published: 2026-08-28
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM Concert 1.0.0 through 2.3.1 contain an improper certificate validation flaw that allows an attacker to intercept and manipulate traffic, enabling unauthorized operations. The weakness is classified as CWE‑295 and can compromise the confidentiality and integrity of communications, potentially resulting in unauthorized remote actions.

Affected Systems

The vulnerability affects IBM's Concert Software versions 1.0.0 up to 2.3.1. Any deployment running one of these releases is at risk until upgraded to the recommended 3.0.0.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would appear to be possible remotely over the network using a man‑in‑the‑middle attack, with no prerequisite authentication. The risk level remains moderate, but mitigation is advised due to potential impact.

Generated by OpenCVE AI on August 28, 2026 at 23:27 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.0 Download IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow  installation instructions https://www.ibm.com/docs/en/concert  depending on the type of deployment.

OpenCVE Recommended Actions

  • Upgrade IBM Concert Software to version 3.0.0 as recommended by IBM.
  • Enforce strict TLS certificate validation on all client and server instances to prevent acceptance of untrusted certificates.
  • Limit network exposure of Concert services by applying firewall rules or restricting access to trusted IP ranges to reduce the attack surface for man‑in‑the‑middle attempts.

Generated by OpenCVE AI on August 28, 2026 at 23:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Description IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.
Title Multiple Vulnerabilities in IBM Concert Software
First Time appeared Ibm
Ibm concert
Weaknesses CWE-295
CPEs cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:2.3.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm concert
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Ibm Concert
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-08-28T20:42:47.328Z

Reserved: 2025-11-06T18:13:00.559Z

Link: CVE-2025-64649

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T22:16:45.913

Modified: 2026-08-28T22:16:45.913

Link: CVE-2025-64649

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T00:30:16Z

Weaknesses
  • CWE-295

    Improper Certificate Validation