CVE-2026-6544
📛 CVE Title
Multiple Vulnerabilities in IBM Concert Software
Description
IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- ibm
- CVSS severity
- MEDIUM
- CVSS score
- 6.2 / 10
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Effective score
- 6.2 / 10 MEDIUM source: CNA overview
- CWE(s)
-
CWE-552 - Reserved
- 2026-04-17
- Published
- 2026-09-24 14:18 UTC
- Last updated
- 2026-09-24 17:49 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/6xxx/CVE-2026-6544.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-24 15:17:30 UTC
- NVD last modified
- 2026-09-24 19:41:16 UTC
- NVD CVSS v3.1
- 6.2 / 10 MEDIUM source: psirt@us.ibm.com
- NVD CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Exploitability subscore
- 2.5 / 10
- Impact subscore
- 3.6 / 10
NVD / KEV / EPSS data refreshed 2026-09-25 04:37 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-86009 - Assigner
- ibm
- Published
- Sep 24, 2026, 2:18:35 PM
- Updated
- Sep 24, 2026, 5:49:47 PM
- EUVD base score (CVSS 3.1)
-
6.2 / 10
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EUVD-reported EPSS
- 0.0000
- Vendors
- IBM
- Products
-
Concert (1.0.0 ≤3.0.0)
- Aliases
-
GHSA-73wh-979r-wrpg
ENISA description: IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| IBM | Concert |
1.0.0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://www.ibm.com/support/pages/node/7288830 vendor-advisorypatch
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://www.ibm.com/support/pages/node/7288830 psirt@us.ibm.com
Remediations (10)
-
web:access.redhat.com
Overall, you have the following options: Upgrade to a supported product version that includes a fix for this vulnerability (recommended). Apply a mitigation (if one exists). Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.
2026-09-25 10:47 UTC -
web:app.opencve.io
Nonetheless, because the flaw enables unauthorized access to privileged pages, it is recommended to treat the vulnerability as a high‑severity but actionable risk until an update is applied or a mitigation is enforced. Generated by OpenCVE AI on September 10, 2026 at 15:16 UTC.
2026-09-25 10:47 UTC -
web:blog.qualys.com
What can I do before Microsoft releases a patch ? Qualys TruRisk™ Eliminate provides a recommended mitigation for CVE - 2026 -69414 that can be applied to affected systems while Microsoft works on a fix . Assets can then be reassessed in Qualys VMDR to verify the remediation outcome.
2026-09-25 10:47 UTC -
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-09-25 10:47 UTC -
web:sec.cloudapps.cisco.com
On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...
2026-09-25 10:47 UTC -
web:www.mozilla.org
Bug 2045368 # CVE - 2026 -74959: Mitigation bypass in the Storage: Cache API component Reporter David Bors at Snyk Security Labs Impact moderate References Bug 2047853 # CVE - 2026 -74960: Site isolation issue in the WebExtensions component Reporter Khanh Nguyen Impact moderate References Bug 2049148 # CVE - 2026 -74961: Side-channel in the Web Audio ...
2026-09-25 10:47 UTC -
web:www.oracle.com
This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.
2026-09-25 10:47 UTC -
web:www.securityweek.com
Vulnerabilities Google Patches 6th Chrome Zero-Day of 2026 Google's Chrome 152 security update resolves 12 vulnerabilities, including a high-severity type confusion flaw in the V8 engine.
2026-09-25 10:47 UTC -
web:www.tenable.com
Microsoft patched 569 CVEs in July 2026 , the largest Patch Tuesday release in its history. 56 critical CVEs patched including three zero-day vulnerabilities.
2026-09-25 10:47 UTC -
web:www.tp-link.com
Recommendations: We strongly recommend that users with affected devices take the following actions: Follow the instructions to update to the latest firmware version to fix the vulnerabilities: EN: Download for Archer MR600 | TP-Link Download for TL-MR6400 | TP-Link Note: Archer MR600 and TL-MR6400 are not sold in the US. Disclaimer: This advisory is provided for informational purposes only and ...
2026-09-25 10:47 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-6544.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6544",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:49:31.088220Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:49:47.771Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"
],
"product": "Concert",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "3.0.0",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.</p>"
}
],
"value": "IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552 Files or Directories Accessible to External Parties",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:18:35.637Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7288830"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.1.1</p><p>Download IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry (<a href=\"https://myibm.ibm.com/products-services/containerlibrary\" rel=\"noopener noreferrer nofollow\">ICR</a>) and follow\u00a0<a href=\"https://www.ibm.com/docs/en/concert?topic=installing-preparing-run-installs-from-private-container-registry\" rel=\"noopener noreferrer nofollow\">installation instructions</a>\u00a0depending on the type of deployment.</p>"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 3.0.1.1\n\n\n\nDownload IBM Concert Software 3.0.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow\u00a0 installation instructions https://www.ibm.com/docs/en/concert \u00a0depending on the type of deployment."
}
],
"title": "Multiple Vulnerabilities in IBM Concert Software"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-6544",
"datePublished": "2026-09-24T14:18:35.637Z",
"dateReserved": "2026-04-17T18:17:27.850Z",
"dateUpdated": "2026-09-24T17:49:47.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}