CVE-2026-19646
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2 and ART 9.0, 9.0.0.1, 9.0.0.2 allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header.
Risk Assessment
An attacker could exploit this to conduct phishing or redirect users to malicious sites, potentially leading to credential theft.
Recommendation
Upgrade IBM Common Licensing Agent and ART to a patched version and enforce Host header validation at the proxy level.
Other vulnerabilities in IBM Common Licensing Agent
See all- CVE-2025-15399Critical
IBM Common Licensing Agent 9.0 and ART 9.0 (including subversions) are vulnerable to cross-site request forgery, allowing an attacker to execute malicious actions from a user that the website trusts.
- CVE-2026-1037Medium
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, altering the intended functionality.
- CVE-2026-1031Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2026-1030Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) generates error messages that include sensitive information about its environment, users, or associated data.
- CVE-2026-1029Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2026-1025Medium
IBM Common Licensing Agent (versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, 9.0.0.1, 9.0.0.2) is vulnerable to cross-site scripting. Users can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
- CVE-2026-19543Medium
IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2 and ART 9.0, 9.0.0.1, 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior.
Original NVD description (English source)
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS