IBM Concert versions 1.0 through 3.0.1.1 have a critical OS command injection vulnerability (CVSS 9.8). According to the vendor's description in the NVD record, it could allow remote attackers to run arbitrary commands on the underlying operating system.
What Is It
CVE-2026-6715 is an OS command injection weakness (CWE-78) in IBM Concert. According to the NVD record, an attacker can supply crafted input that ends up inside an operating system command without proper validation or sanitization. If exploited, it could let a remote attacker run arbitrary commands on the host with the same privileges as the affected service.
IBM's PSIRT ([email protected]) reported the CVE, and NVD published it on 2026-11-08. NVD lists its status as "Awaiting Analysis," so NVD has not yet run its own independent assessment.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practical terms:
- Network-reachable: an attacker can exploit it remotely.
- Low complexity: no special conditions are needed.
- No privileges required: the attacker does not need to log in.
- No user interaction: nobody has to click or open anything.
- High impact on confidentiality, integrity and availability: a successful attack gives command execution on the host.
A flaw that is remotely reachable, needs no login and leads to command execution is among the most serious kinds an organization can face. It should be treated as a priority wherever IBM Concert is exposed.
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE. CISA has not confirmed active exploitation in the source material, and none is claimed here.
What's Vulnerable
- Vendor: IBM
- Product: Concert
- Affected versions: 1.0 through 3.0.1.1 (inclusive)
The CPE entries in the NVD record list cpe:2.3:a:ibm:concert:1.0 and cpe:2.3:a:ibm:concert:1.0.0. The version data in the same record marks the whole range from 1.0 up to and including 3.0.1.1 as affected.
Patch Status
The supplied NVD data does not name a fixed version. IBM has published a support page for this issue (linked below). Administrators should check that advisory for remediation guidance and fixed releases, and apply the vendor's recommended update to any Concert deployment running 1.0 through 3.0.1.1.
No KEV entry was provided, so no CISA required action or federal remediation deadline applies based on the supplied data.