Description
IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.
Published: 2026-09-23
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Code Execution when the system PATH can be manipulated by a user with local system access
Action: Immediate Patch
AI Analysis

Impact

IBM Concert Software versions 1.0.0 through 3.0.0 execute operating‑system commands without fully qualifying executable paths or restricting the search path. This untrusted search path weakness (CWE‑427) can allow an attacker who already has local system access to manipulate the PATH environment and cause the system to launch untrusted or malicious code.

Affected Systems

All instances of IBM Concert Software 1.0.0 and 3.0.0 are affected. The vendor recommends upgrading to IBM Concert Software 3.0.1.1 to remediate the issue.

Risk and Exploitability

The CVSS score of 7.8 denotes a high severity vulnerability, but the EPSS score is not available and it is not listed in CISA KEV. Exploitation requires local system access and the ability to alter the PATH environment for the IBM Concert process. Depending on the deployment, this may be relatively difficult for an attacker who cannot change system environment variables, yet the potential for local code execution warrants rapid remediation.

Generated by OpenCVE AI on September 23, 2026 at 22:25 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.1.1 Download IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow  installation instructions https://www.ibm.com/docs/en/concert  depending on the type of deployment.

OpenCVE Recommended Actions

  • Upgrade IBM Concert Software to version 3.0.1.1 as recommended by IBM
  • If an upgrade cannot be performed immediately, ensure that the PATH environment variable is explicitly set to a trusted directory and that the IBM Concert process runs with the minimal required privileges
  • For deployments where the IBM Concert service account can be altered, restrict modification of environment variables for that account and audit any changes to the PATH

Generated by OpenCVE AI on September 23, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel

Thu, 24 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.
Title Multiple Vulnerabilities in IBM Concert Software
First Time appeared Ibm
Ibm concert
Weaknesses CWE-427
CPEs cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm concert
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Concert
Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-25T03:55:19.793Z

Reserved: 2026-04-23T19:01:57.529Z

Link: CVE-2026-6935

cve-icon Vulnrichment

Updated: 2026-09-24T13:31:55.723Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T21:17:02.553

Modified: 2026-09-29T14:00:54.787

Link: CVE-2026-6935

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T23:15:10Z

Weaknesses
  • CWE-427

    Uncontrolled Search Path Element