CVE-2026-15661: IBM Concert Software Improper Output Neutralization for Logs

Q: Which versions are affected?

IBM Concert versions 1.0 through 3.0.0 are affected.

Q: Does exploitation require authentication or user interaction?

No. The listed vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the impact of a successful exploit?

An unauthorized user may inject data into log messages. The provided impact vector indicates integrity impact only, with no stated confidentiality or availability impact.

Published Oct 14, 2026

Updated

IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

Other sources

IBM Concert Software could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

— IBM

Affected Software

2 affected components

IBM Concert>=1.0<=3.0.0

IBM Concert Software<=1.0-3.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Concert Software to a version that resolves this vulnerability.
Fixed in 3.0.1.1

Event History

Oct 14, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 19, 2026

CVE Published

via MITRE·05:11 PM

Data Sourced

via MITRE·05:11 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7292374

Frequently Asked Questions

Which versions are affected?

IBM Concert versions 1.0 through 3.0.0 are affected.

Does exploitation require authentication or user interaction?

No. The listed vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the impact of a successful exploit?

An unauthorized user may inject data into log messages. The provided impact vector indicates integrity impact only, with no stated confidentiality or availability impact.

CVE-2026-15661: IBM Concert Software Improper Output Neutralization for Logs

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Which versions are affected?

Does exploitation require authentication or user interaction?

What is the impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Which versions are affected?

Does exploitation require authentication or user interaction?

What is the impact of a successful exploit?