IBM Common Licensing CVE-2026-19543

Exploitation requires local system access to a host running IBM Common Licensing Agent or ART versions 9.0 through 9.0.0.2. The CVSS vector specifies AV:L (local attack vector) and PR:N (no privileges required), meaning any local user - including low-privilege accounts - can potentially interact with the licensing agent's local interface. The attacker must be able to observe or intercept the request format used by the client component, then craft or replay modified requests to the server-side endpoint. Exploitation is limited to local access only (not remotely exploitable over a network), and SSVC confirms it is not automatable. There is no requirement for prior authentication to the licensing system itself, but physical or remote shell access to the host is a prerequisite.

The NVD-assigned CVSS score of 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a medium-severity issue where the sole impact is high availability - notably omitting any integrity impact despite the description explicitly describing unauthorized value injection. This represents an internal inconsistency: submitting unauthorized values to bypass validation controls should produce at minimum an integrity impact (I:L or I:H), and the A:H impact alone (with C:N/I:N) is difficult to reconcile with a generic validation bypass without additional technical detail. The 'Authentication Bypass' tag in the input metadata is also misleading - the vulnerability is a client-side input validation gap (CWE-20), not an authentication bypass (CWE-287/306). SSVC rates exploitation as none and automatable as no, which is consistent with the AV:L local access requirement. No CISA KEV listing, no POC, and EPSS data is absent, making this a theoretical risk with limited real-world urgency for most organizations. The principal concern would be in environments where the licensing agent's integrity directly gates access to IBM software entitlements.

A local user on a system running IBM Common Licensing Agent identifies the local API or IPC endpoint the client communicates with, then uses a proxy tool or crafted script to replay modified requests with parameter values outside the ranges the client-side UI enforces. By submitting these unauthorized values directly to the unprotected server component, the attacker causes the licensing agent to enter an unintended state - potentially crashing the service and blocking IBM software from validating licenses. No public exploit code exists at time of analysis.