CVE-2026-6721
published 2026-09-23CVE-2026-6721: IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting…
PriorityP274critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.45%
73.2th percentile
IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the affected application.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | concert | 1.0.0 – 3.0.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Concert up to 3.0.0 os command injection
vuldb·2026-09-23·CVSS 9.8
CVE-2026-6721 [CRITICAL] IBM Concert up to 3.0.0 os command injection
A vulnerability described as very critical has been identified in IBM Concert up to 3.0.0. Affected is an unknown function. Such manipulation leads to os command injection.
This vulnerability is uniquely identified as CVE-2026-6721. The attack can be launched remotely. No exploit exists.
GHSA
IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the unde
ghsa_unreviewed·2026-09-23
CVE-2026-6721 [CRITICAL] CWE-78 IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the unde
IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the affected application.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-23
Published