EUVD-2026-83141
GHSA-mg6f-fphr-7chf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network XSS (PR:N/AV:N/AC:L) requiring victim interaction (UI:R); script runs in the victim's trusted context (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
AnalysisAI
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2) Web UI lets an unauthenticated attacker embed arbitrary JavaScript that executes in a victim's browser session, potentially altering page behavior and exposing credentials. The vulnerability is remote and requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1), meaning a user - typically an administrator or operator - must load the attacker-influenced page inside an authenticated, trusted session for the payload to fire; no attacker authentication is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the IBM Common Licensing Agent/ART Web UI and requires an XSS injection point reachable by the attacker plus victim user interaction (UI:R) - a user (typically an administrator/operator) must load the attacker-influenced page within an authenticated, trusted session for the payload to fire and disclose credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has published a fix for CVE-2026-1037 - patch availability is confirmed by the vendor (IBM support page node/7286490), although the specific patched version number is not enumerated in the provided data, so administrators should consult that advisory to obtain the exact updated release for Common Licensing Agent and ART and upgrade all 9.0.x installs (9.0, 9.0.0.1, 9.0.0.2) accordingly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Common Licensing
View allCross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized a
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injec
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have acce
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leavin
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium sev
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated at
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthen
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerabil
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting To
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today