Vulnerability · Published Aug 28, 2026 · Assigned by ibm

CVE-2025-64649Multiple Vulnerabilities in IBM Concert Software

Medium 5.9

In plain English

A medium-severity improper certificate validation in Concert from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 87.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation.

Affected products (as reported)

Vendor	Product	Versions
IBM	Concert	1.0.0 – through 2.3.1

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://www.ibm.com/support/pages/node/7285337 vendor-advisory, patch