CVE-2025-15399
CriticalCVSS 10.0Summary
IBM Common Licensing Agent 9.0 and ART 9.0 (including subversions) are vulnerable to cross-site request forgery, allowing an attacker to execute malicious actions from a user that the website trusts.
Risk Assessment
An attacker can perform unauthorized actions on behalf of an authenticated user.
Recommendation
Implement CSRF protections like tokens and educate users about suspicious links.
Other vulnerabilities in IBM Common Licensing Agent
See all- CVE-2026-1037Medium
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering the intended functionality.
- CVE-2026-1031Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2026-1030Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) generates error messages that include sensitive information about its environment, users, or associated data.
- CVE-2026-1029Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2026-1025Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2026-19646Critical
IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2 and ART 9.0, 9.0.0.1, 9.0.0.2 allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header.
- CVE-2026-19543Medium
IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2 and ART 9.0, 9.0.0.1, 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior.
Original NVD description (English source)
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.