IBM has disclosed a critical command-injection flaw in its Concert software that could let a remote attacker run any system command on the host, without logging in. The vulnerability, tracked as CVE-2026-15266, carries a severity rating of 9.8 out of 10 under CVSS version 3.1.

According to IBM's security bulletin, Concert versions 1.0 through 3.0.1.1 contain components that allow potentially unsafe command execution. An attacker exploiting the flaw could run arbitrary system commands, potentially taking full control of the affected system. The weakness is classed as CWE-78, improper neutralisation of special elements in an operating-system command.

No login needed, network attack

The flaw is rated as network-reachable, low complexity, and needing no privileges and no user interaction, the combination that makes it most dangerous for internet-facing deployments. IBM scored the impact as high for confidentiality, integrity and availability alike.

What users should do

IBM's bulletin lists the flaw among a batch of Concert vulnerabilities. The CVE record does not name a fixed release, so administrators should check IBM's security bulletin for the latest patched version and apply it as soon as it is available. Until then, organisations should limit network access to Concert systems and watch for unusual activity.

IBM Concert is used to manage and automate IT operations, so a compromised deployment could give an attacker a foothold deep inside an organisation's infrastructure. Security teams are advised to treat this as a priority patch.