IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation, a weakness (CWE-295) that may allow an attacker to bypass TLS authentication by presenting a forged or self‑signed certificate. The vulnerability has a CVSS score of 3.7, indicating low severity, but it can lead to confidentiality compromise if an attacker successfully deceives clients or servers into trusting an invalid certificate.

Affected products are IBM Concert versions 1.0 to 3.0.0. IBM recommends upgrading to IBM Concert Software 3.0.1.1 to remediate the issue. No specific sub‑variant or build information is provided, so any deployment running the affected range is at risk.

The risk is low based on the CVSS score, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation. Based on the description, it is inferred that the attack vector is remote network, where an attacker could interpose a forged certificate between a client and server, potentially enabling a man‑in‑the‑middle attack if certificate validation is disabled or improperly configured.