HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-6935 — IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully ...

·Source: NIST NVD

Updated:

Executive Summary

IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.

Analysis

IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code. CVSS Score: 7.8. Published: 2026-09-23T21:17:02.553.

Indicators of Compromise (1)

CVE (1)
CVE-2026-6935
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 23, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Signal adds encypted local backup support to iOS, desktop apps

Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows). [...]

BleepingComputer
LOWVulnerability

Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution

A patched Unsloth Studio vulnerability allows malicious AI models to execute arbitrary Python code during inspection, via the trust_remote_code setting.

Dark Reading
MEDIUMVulnerability

US Air Force members given over 6 years in prison for cyber theft of more than $2 million

According to court documents, both men pleaded guilty to wire fraud, identity theft and access device fraud charges in June.

The Record