{"id":"CVE-2026-15266","published":"2026-11-08T18:17:02.450","lastModified":"2026-11-10T05:18:01.390","description":"IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7294607","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Concert versions 1.0 through 3.0.1.1 contain components vulnerable to command injection (CWE-78), allowing unauthenticated remote attackers to execute arbitrary system commands on the host. This is a critical flaw due to the CVSS 9.8 score indicating full confidentiality, integrity, and availability impact.","exploitability":"Exploitation requires no authentication or user interaction and can be performed remotely over the network with low technical complexity, assuming the vulnerable component is exposed.","blast_radius":"Successful exploitation would allow attackers to fully compromise the affected system, including stealing sensitive data, installing backdoors, or pivoting to other systems within the network.","remediation":"Upgrade IBM Concert to version 3.0.1.2 or later, as this is the first fixed release addressing CVE-2026-15266.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","web","network"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:43:47.033Z"}}