{"id":"CVE-2026-6715","published":"2026-11-08T19:17:39.980","lastModified":"2026-11-10T05:18:06.910","description":"IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7294607","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Concert versions 1.0 through 3.0.1.1 contains a command injection vulnerability (CWE-78) where unsanitized user input is passed to an OS command, enabling remote code execution. This is critical due to the CVSS score of 9.8 and lack of authentication or user interaction requirements.","exploitability":"Exploitation is straightforward for remote attackers with network access, requiring only delivery of a malicious payload to the vulnerable input point; no privileges or user interaction are needed.","blast_radius":"Successful exploitation grants full system compromise with service account privileges, potentially enabling lateral movement, data exfiltration, or infrastructure disruption across affected environments.","remediation":"Upgrade IBM Concert to version 3.0.1.2 or later, as this is the first fixed release addressing CVE-2026-6715.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","cmd-injection","webapp","critical"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:43:58.334Z"}}