CVE-2026-15661: IBM Concert Software Improper Output Neutralization for Logs
IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
Other sources
IBM Concert Software could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Concert Softwareto a version that resolves this vulnerability.Fixed in 3.0.1.1
Event History
Frequently Asked Questions
Which versions are affected?
IBM Concert versions 1.0 through 3.0.0 are affected.
Does exploitation require authentication or user interaction?
No. The listed vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the impact of a successful exploit?
An unauthorized user may inject data into log messages. The provided impact vector indicates integrity impact only, with no stated confidentiality or availability impact.