CVE-2026-16426
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
IBM Concert is vulnerable to server-side request forgery (SSRF). An authenticated attacker may send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Risk Assessment
The SSRF vulnerability may allow an attacker to probe the internal network and reach services not exposed externally, increasing the attack surface.
Recommendation
Update IBM Concert to a patched version and restrict outbound network requests while implementing URL validation.
Other vulnerabilities in IBM Concert
See all- CVE-2026-6935High
IBM Concert 1.0.0 through 3.0.0 invokes OS commands without fully qualifying executable paths or adequately restricting search path resolution. An attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.
- CVE-2026-6925Medium
IBM Concert versions 1.0.0 through 3.0.0 allows a remote attacker to traverse directories by sending a crafted URL request containing "dot dot" sequences. This enables viewing arbitrary files on the system.
- CVE-2026-6794High
IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process.
- CVE-2026-6718Medium
IBM Concert versions 1.0.0 through 3.0.0 is vulnerable to improper access control, allowing unauthorized modification of application files.
- CVE-2026-6327Medium
IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
- CVE-2026-3626Medium
IBM Concert versions 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
- CVE-2025-33015High
IBM Concert versions 1.0.0 through 2.1.0 is vulnerable to malicious file upload due to lack of content validation for files uploaded to the web interface. An attacker could exploit this to upload harmful files.
- CVE-2026-6928Critical
IBM Concert versions 1.0.0 through 3.0.0 references or accesses memory after it has been freed (use-after-free). An attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.
- CVE-2026-6730Critical
IBM Concert versions 1.0.0 through 3.0.0 is vulnerable to a buffer overflow caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.
- CVE-2026-6721Critical
IBM Concert versions 1.0.0 through 3.0.0 allows an unauthenticated remote attacker to supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution. Successful exploitation allows remote code execution with the privileges of the affected application.
Original NVD description (English source)
IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.