What is the CVSS score of CVE-2025-15399?

CVE-2025-15399 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Common Licensing are affected by CVE-2025-15399?

IBM Common Licensing Agent and ART 9.0.x are affected by a critical cross-site request forgery vulnerability (CVE-2025-15399) that could allow an attacker to execute unauthorized actions on behalf of…. A patch is available.

How to fix or mitigate CVE-2025-15399?

Within 24 hours, inventory all instances of IBM Common Licensing Agent and ART 9.0.x, with particular attention to systems with user-accessible licensing web interfaces, and restrict access where feasible. Within 7 days, apply the patch available per vendor advisory to all affected systems, and remind users to avoid visiting suspicious links while authenticated. Within 30 days, verify patch deployment across all environments, review logs for any unauthorized actions, and conduct a follow-up assessment to ensure no residual risk.

IBM Common Licensing CVE-2025-15399

EUVD-2025-210953 CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-09-18 ibm

GHSA-2vwg-4434-qc95

CSRF IBM Common Licensing

10.0

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

CSRF requires the victim to be tricked into submitting a request, so UI:R and S:U; impact is state-changing unauthorized actions (I:H) with no inherent confidentiality/availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 16:16 vuln.today

CVE Published

Sep 18, 2026 - 15:38 cve.org

CRITICAL 10.0

DescriptionCVE.org

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

AnalysisAI

Cross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized actions on behalf of an authenticated user, with high integrity impact but no confidentiality or availability impact. Exploitation requires the victim to visit a malicious page while authenticated to the licensing web interface; no public exploit identified at time of analysis. Vendor assigned CVSS 10.0, but independent analysis assesses a more moderate risk due to the UI:R and S:U characteristics typical of CSRF.

Technical ContextAI

The vulnerability is a classic cross-site request forgery (CSRF, CWE-352) affecting the web interface of IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2. The CPE cpe:2.3:a:ibm:common_licensing:*:*:*:*:*:*:*:* indicates the flaw resides in the common licensing component. CSRF occurs when the application fails to verify that a request originated from its own origin, allowing an attacker to craft a malicious link or page that, when visited by an authenticated user, triggers unintended actions within the licensing interface. The vendor's CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) rates this as a perfect 10.0, but this is anomalous for CSRF; the independent assessment (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects the necessary user interaction and scope-unchanged characteristics, limiting the achievable impact to integrity violations bounded by the victim's privileges.

RemediationAI

Patch available per vendor advisory: apply the fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7286490. No exact patch version is specified, but the advisory provides the necessary updates for Common Licensing Agent and ART 9.0 through 9.0.0.2. Until patching, reduce risk by ensuring the licensing web interface is only accessible from trusted management networks, avoiding exposure to untrusted networks. Administrators should log out after use and refrain from browsing other sites in the same browser session, or use a dedicated browser profile for administrative tasks. These measures lower the likelihood of a successful CSRF attack but do not fully eliminate the risk; applying the vendor patch is the definitive remediation.