CVE-2026-6715

CRITICAL9.8

Published 2026-11-08 · Updated 2026-11-08 · Source psirt@us.ibm.com

Description

IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-78

References

https://www.ibm.com/support/pages/node/7294607

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-119506
Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
2026-11-09 · score 9.1
CVE-2026-17466
IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
2026-11-08 · score 9.1
CVE-2026-15266
IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.
2026-11-08 · score 9.8
CVE-2026-114464
IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.
2026-11-08 · score 9.3
CVE-2026-107331
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
2026-11-08 · score 9.9