CVE-2026-16426
published 2026-09-22CVE-2026-16426: IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests…
PriorityP338medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.19%
8.6th percentile
IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | concert | 1.0.0 – 3.0.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF).
ghsa_unreviewed·2026-09-23
CVE-2026-16426 [MEDIUM] CWE-918 IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF).
IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
VulDB
IBM Concert up to 3.0.0 server-side request forgery
vuldb·2026-09-22·CVSS 6.5
CVE-2026-16426 [MEDIUM] IBM Concert up to 3.0.0 server-side request forgery
A vulnerability classified as critical was found in IBM Concert up to 3.0.0. This impacts an unknown function. Such manipulation leads to server-side request forgery.
This vulnerability is listed as CVE-2026-16426. The attack may be performed from remote. There is no available exploit.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-22
Published