IBM Concert Software versions 1.0 through 3.0.1.1 contain components that permit unsafe execution of operating‑system commands. Such a flaw can allow an attacker to run arbitrary commands on the host machine, effectively breaking confidentiality, integrity, and availability of the affected system. The vulnerability is classified as a command execution flaw (CWE‑78).

This issue affects the IBM Concert product family, specifically all releases from 1.0 up to and including 3.0.1.1. IBM recommends upgrading to Concert Software 3.1.0, which contains the necessary fixes. No other versions are known to be impacted, and the vendor’s advisory states that 3.1.0 is the current release that addresses the problem.

The CVSS score of 9.8 categorizes this as a critical severity vulnerability. EPSS data is not available, but the lack of an EPSS entry does not reduce the risk implied by the high CVSS. The vulnerability is not listed in the CISA KEV catalog, but because it permits unrestricted command execution, a remote attacker with access to the vulnerable components could exploit it without needing local access. The impact is system‑wide, as any arbitrary command can be executed with the privileges of the Concert service. This makes the risk both high and potentially easy to exploit once the vulnerable component is reachable.