CVE-2026-6928 - Multiple Vulnerabilities in IBM Concert Software

Back Back to CVE browser

CRITICAL

Multiple Vulnerabilities in IBM Concert Software

Published Sep 23, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.45%

Description

IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.

Affected products

Vendor IBM Product Concert Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  <=3.0.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

Concert

n/a

Version	Status	Constraints
1.0.0	affected	<=3.0.0

Remediation

Vendor solution

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.1.1

Download IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow installation instructions https://www.ibm.com/docs/en/concert depending on the type of deployment.

Weaknesses (1)

CWE-416

Use After Free