CVE-2026-16426 is a server-side request forgery (SSRF) vulnerability in IBM Concert affecting versions 1.0.0 through 3.0.0. An authenticated attacker can abuse this vulnerability to make the server send unauthorized requests, potentially allowing network reconnaissance or facilitating other attack vectors. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality and integrity impacts are low, with no availability impact.

An attacker with authentication can leverage this SSRF vulnerability to cause the IBM Concert server to send unauthorized requests. This can lead to network enumeration and may assist in further attacks against internal or external resources accessible from the server. The impact on confidentiality and integrity is considered low, and there is no impact on availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected IBM Concert versions and monitor for suspicious activity involving SSRF exploitation attempts.