CVE-2026-19543
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2 and ART 9.0, 9.0.0.1, 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior.
Risk Assessment
Lack of server-side validation may allow an attacker to manipulate data and cause unintended application behavior, potentially compromising system integrity.
Recommendation
Apply patches from IBM or configure the server to enforce input validation on the server side.
Other vulnerabilities in IBM Common Licensing Agent
See all- CVE-2026-1037Medium
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering the intended functionality.
- CVE-2026-1031Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2026-1030Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) generates error messages that include sensitive information about its environment, users, or associated data.
- CVE-2026-1029Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2026-1025Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2025-15399Critical
IBM Common Licensing Agent 9.0 and ART 9.0 (including subversions) are vulnerable to cross-site request forgery, allowing an attacker to execute malicious actions from a user that the website trusts.
- CVE-2026-19646Critical
IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2 and ART 9.0, 9.0.0.1, 9.0.0.2 allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header.
Original NVD description (English source)
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior.