CVE-2026-6327: Multiple Vulnerabilities in IBM Concert Software
Published Sep 22, 2026
·Updated
IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
Other sources
IBM Concert could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.
— IBM
Affected Software
3 affected components
IBM Concert Software<=1.0.0-3.0.0
All of the following
IBM Concert>=1.0.0<=3.0.0
Linux Linux kernel
Remediation
Information
IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.1.1
Download IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow installation instructions https://www.ibm.com/docs/en/concert depending on the type of deployment.
Patch Available
Event History
Sep 22, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 23, 2026
CVE Published
via MITRE·03:50 PM
Data Sourced
via MITRE·03:50 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Is authentication required to exploit this issue?
No. The issue is described as allowing an unauthorized user to inject data into log messages.