CVE-2026-6721 is a critical (CVSS 9.8) OS command injection flaw in IBM Concert 1.0.0 through 3.0.0 that lets an unauthenticated remote attacker run arbitrary commands on the underlying system.
What Is It
CVE-2026-6721 is an OS command injection vulnerability (CWE-78) in IBM Concert. IBM's PSIRT, which reported the issue, says an unauthenticated remote attacker can send specially crafted input that ends up inside OS commands. This leads to arbitrary command execution on the underlying system. A successful attack gives the attacker remote code execution with the privileges of the affected application.
NVD published the record on 2026-09-23. Its status is currently "Received," so NVD has not yet completed its own analysis.
Why It Matters
The vendor-supplied CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- Network attack vector: it can be exploited remotely.
- Low attack complexity: no special conditions are needed.
- No privileges required: no authentication is needed.
- No user interaction: no victim has to take any action.
- High impact to confidentiality, integrity, and availability.
An attacker who can reach an exposed IBM Concert instance could take over the host within the application's privilege context.
Exploitation status: CVE-2026-6721 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation, and there is no CISA-mandated required action or due date.
What's Vulnerable
- Vendor: IBM
- Product: Concert
- Affected versions: 1.0.0 through 3.0.0 inclusive (semver range, 1.0.0 ≤ version ≤ 3.0.0)
- Listed CPEs:
cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*
Treat any IBM Concert deployment in this version range as vulnerable.
Patch Status
The NVD record does not list a fixed version or specific remediation steps. IBM has published a security bulletin for this issue, linked below. Administrators should check that bulletin for the fixed release and any mitigations. Until a fix is applied, it is prudent to limit network exposure of IBM Concert instances, given the unauthenticated, network-reachable attack path. If CISA later adds this CVE to KEV, a formal required action and due date will apply to federal agencies.