ByteOS Network

CVE Vulnerability Details :

CVE-2025-36018

PUBLISHED

More Info Official Page

Assigner-ibm

Assigner Org ID-9a959283-ebb5-44b6-b705-dcc2bbced522

Published At-17 Feb, 2026 | 18:54

Updated At-17 Feb, 2026 | 21:42

▼CVE Numbering Authority (CNA)

Multiple Vulnerabilities in IBM Concert Software.

IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Affected Products

Vendor

IBM Corporation

Product

Concert

CPEs

cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:2.1.0:*:*:*:*:*:*:*

Versions

Affected

From 1.0.0 through 2.1.0 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-352	CWE-352 Cross-Site Request Forgery (CSRF)

Type: CWE

CWE ID: CWE-352

Description: CWE-352 Cross-Site Request Forgery (CSRF)

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Solutions

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Concert Software 2.2.0 Download IBM Concert Software 2.2.0 from Container software library section of IBM Entitled Registry ( ICR ) and follow installation instructions depending on the type of deployment.

References

Hyperlink	Resource
https://www.ibm.com/support/pages/node/7260162	vendor-advisory patch

Hyperlink: https://www.ibm.com/support/pages/node/7260162

Resource:

vendor-advisory

patch

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References