CVE-2026-6928

Multiple Vulnerabilities in IBM Concert Software

View on CVE.org
Published Sep 23, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.

Analysis

AI-generated

Technical impact

IBM Concert Software versions 1.0.0 through 3.0.0 have a use‑after‑free flaw (CWE-416) that allows an attacker who can influence program execution or supply input to corrupt memory, crash the application, or execute arbitrary code, potentially compromising integrity and leading to remote code execution.

Affected Systems

IBM Concert Software from version 1.0.0 up to 3.0.0 is affected. IBM recommends upgrading to Concert Software 3.0.1.1 as the remediation, which resolves the use‑after‑free issue.

Risk and Exploitability

The flaw receives a CVSS score of 9.8, indicating critical severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploitation requires an attacker to influence execution or input, the attack vector is likely remote if such input can be supplied; local vectors are also possible. Given the high severity and the potential for arbitrary code execution, the risk remains high until a patched version is deployed.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.1.1 Download IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow  installation instructions https://www.ibm.com/docs/en/concert  depending on the type of deployment.

OpenCVE Recommended Actions

  • Upgrade to IBM Concert Software 3.0.1.1 via the IBM Entitled Registry and follow the installation instructions to replace any vulnerable instance.
  • Replace all affected environments with the fixed version, ensuring that no instance continues to run a vulnerable episode.
  • If an upgrade cannot be performed immediately, enforce strict input validation and sanitization to reduce the chance that crafted input triggers memory corruption.

Generated by OpenCVE AI on September 23, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.
Title Multiple Vulnerabilities in IBM Concert Software
First Time appeared Ibm
Ibm concert
Weaknesses CWE-416
CPEs cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm concert
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Sep 25, 2026, 3:55 AM
Reserved
Apr 23, 2026, 5:54 PM

View source JSON

Updated
Sep 24, 2026, 2:38 PM

JSON

Status
Analyzed
Published
Sep 23, 2026, 9:17 PM
Modified
Sep 29, 2026, 2:08 PM

View source JSON

No data.

Updated
Sep 24, 2026, 1:15 AM

JSON