IBM Concert: Arbitrary command execution (CVE-2026-15266)
IBM Concert versions 1.0 through 3.0.1.1 contain components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.
CVE search metadata
CVE search record: CVE-2026-15266. Severity: critical. CVSS: 9.8. KEV: no. Product: Concert (1.0 through 3.0.1.1). Brief: IBM Concert: Arbitrary command execution (CVE-2026-15266). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-concert-rce/
Triage facts
Revision 2- Applicability
- Concert (1.0 through 3.0.1.1)
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 8, 20:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
IBM Concert versions 1.0 through 3.0.1.1 contain components that allow potentially unsafe command execution. This vulnerability could be exploited to run arbitrary system commands on the host. The issue has been assigned a CVSS v3.1 base score of 9.8.