VulnerabilityAnalyzed

CVE-2026-6928

This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.

CRITICAL 9.8EPSS 0.46%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.46%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.46% probability · 40th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-416
Affected: ibm/concert
Source: psirt@us.ibm.com

EPSS trend

EPSS moved from 0.4% on 24 September 2026 to 0.5% on 26 October 2026.

References

https://www.ibm.com/support/pages/node/7288830Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.