IBM Concert versions 1.0 through 3.0.1.1 contain components that allow potentially unsafe command execution, which an attacker could use to run arbitrary system commands on the host.
What Is It
CVE-2026-15266 is an OS command injection weakness (CWE-78) in IBM Concert. According to the NVD record, which IBM's PSIRT ([email protected]) submitted, the product "contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host."
NVD published the record on 2026-11-08. Its status is "Awaiting Analysis," so NVD has not yet added its own enrichment to the vendor's submission.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practice:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: no special conditions are needed.
- No privileges or user interaction: an unauthenticated attacker can trigger it without help from a victim.
- High impact on confidentiality, integrity, and availability: successful exploitation gives command execution on the underlying host.
The exploitability subscore is 3.9 and the impact subscore is 5.9.
Exploitation status: CVE-2026-15266 does not currently appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied sources do not confirm active exploitation, and no CISA-mandated remediation deadline applies right now. Even so, the severity profile makes it a strong candidate for priority patching.
What's Vulnerable
- Vendor: IBM
- Product: Concert
- Affected versions: 1.0 through 3.0.1.1 (inclusive)
The vendor-supplied CPE entries in the NVD record include:
cpe:2.3:a:ibm:concert:1.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
The version range given above covers every release up to and including 3.0.1.1.
Patch Status
IBM has published a security bulletin for this vulnerability (linked below). The supplied NVD data does not name a fixed version. Organizations running IBM Concert 1.0 through 3.0.1.1 should check IBM's advisory for the remediation steps and the fixed release, then apply them promptly.
Because there is no KEV listing, CISA has issued no federal required action for this CVE so far. Defenders should watch the KEV catalog in case that changes.