CVE-2026-6935: Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.
Other sources
IBM Concert invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.
— IBM
Affected Software
Remediation
Information
Patch Available
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize IBM Concert systems where users or local processes may be able to influence the operating system search path. The issue requires local system access, so environments with tightly controlled local access have a narrower exposure path.
Are affected versions, detection steps, or temporary mitigations provided?
The provided information does not identify affected versions, detection indicators, or a workaround for systems that cannot be patched immediately.