IBM has disclosed a critical (CVSS 9.1) unauthenticated SQL injection flaw in IBM Concert versions 1.0.0 through 2.3.1 that could allow a remote attacker to read or tamper with back-end database contents.
What Is It
CVE-2026-3627 is a SQL injection vulnerability in IBM Concert. According to IBM's PSIRT advisory, a remote attacker can send specially crafted SQL statements to the application, which could allow the attacker to view, add, modify, or delete information in the back-end database.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, scoring 9.1 (Critical). Every exploitability dimension is at its worst: network-reachable, low attack complexity, no privileges required, and no user interaction. Impact is High for both confidentiality and integrity, with no availability impact; this is a data theft and data manipulation bug, not a denial-of-service one.
Why It Matters
An unauthenticated, network-reachable SQLi in an enterprise application is about as clean an initial-access and data-exfiltration primitive as it gets. There is no credential barrier and no phishing step. Per IBM's description, a successful attack could expose whatever data Concert holds and could let an attacker add, modify, or delete records; with consequences for the integrity of anything downstream that trusts that data.
CVE-2026-3627 does not appear in the CISA Known Exploited Vulnerabilities catalog as of this writing, so active exploitation has not been confirmed by CISA at this time. The absence of a KEV listing is not evidence of safety; it simply means the vulnerability has not been added to the catalog.
What's Vulnerable
- Vendor: IBM
- Product: Concert
- Affected versions: 1.0.0 through 2.3.1 inclusive (semver range,
1.0.0≤ version ≤2.3.1)
Listed CPEs cover cpe:2.3:a:ibm:concert:1.0.0 and cpe:2.3:a:ibm:concert:2.3.1.
Patch Status
The NVD record was published on 2026-08-28 with a status of "Received," meaning NVD analysis was still pending at the time of writing. The NVD entry states no fixed version number, and no CISA-mandated remediation deadline applies given the absence of a KEV listing.
Administrators should consult IBM's support advisory (node 7285337) directly for the remediation and fixed-release guidance associated with this CVE.
Sources
- NVD, CVE-2026-3627: https://nvd.nist.gov/vuln/detail/CVE-2026-3627
- IBM Support Advisory ([email protected]): https://www.ibm.com/support/pages/node/7285337
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog