Cyber & AI intelligence
Wasteland.
Briefs indexed2842
Issues29
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-17472 2026-09-22

IBM Concert RBAC Wildcard Flaw Lets Authenticated Users Reach Unauthorized Resources (CVE-2026-17472)

"A critical-severity privilege management flaw in IBM Concert 1.0.0 through 3.0.0 allows a remote authenticated attacker to access or modify resources they should not be able to touch, because RBAC permission definitions…"

A critical-severity privilege management flaw in IBM Concert 1.0.0 through 3.0.0 allows a remote authenticated attacker to access or modify resources they should not be able to touch, because RBAC permission definitions use wildcards.

What Is It

CVE-2026-17472 is an improper privilege management issue (CWE-269) in IBM Concert. Per the vendor advisory reported through IBM PSIRT, the product defines role-based access control permissions using wildcards. The overly broad matching means a remote authenticated attacker can access or modify unauthorized resources.

The CVE carries a CVSS 3.1 base score of 9.6 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The vector breaks down as network-reachable, low attack complexity, low privileges required, and no user interaction; with a scope change, high confidentiality impact, and high integrity impact.

Why It Matters

The combination of a low privilege requirement and a changed scope is what drives this to 9.6. An attacker needs only an existing low-privileged account, no user interaction, and no local access. From there the wildcard permission grants reach beyond the security boundary the account was issued under, exposing both read (confidentiality: HIGH) and write (integrity: HIGH) access to resources outside the intended role. Availability is not impacted.

Any deployment where Concert accounts are issued broadly, or where a lower-trust user or service identity holds a Concert login, should be treated as directly exposed.

What's Vulnerable

No other IBM products are named in the supplied record.

Patch Status

The CVE was published 2026-09-22 with an NVD vulnerability status of Received, meaning NVD analysis was not yet complete at the time of this record. The only reference supplied is IBM's support advisory node 7288830, which is the authoritative source for fix availability and upgrade guidance for affected Concert deployments.

This CVE does not appear in the supplied CISA KEV data (CISA Known Exploited Vulnerabilities Catalog), so there is no KEV-confirmed active exploitation and no KEV-mandated required action or remediation due date associated with it.

Sources