What is the CVSS score of CVE-2026-19646?

CVE-2026-19646 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Common Licensing are affected by CVE-2026-19646?

IBM Common Licensing (versions 9.0-9.0.0.2) contains an HTTP Host header injection vulnerability that enables open redirects, creating significant phishing and credential theft risk against employees…. A patch is available.

How to fix or mitigate CVE-2026-19646?

Within 24 hours, inventory all deployments of IBM Common Licensing 9.0 through 9.0.0.2 across your environment and disable any internet-facing instances that cannot be immediately patched. Within 7 days, apply the vendor-released patch (available from IBM support node 7286490) to all affected Agent and ART systems, prioritizing authentication-critical and externally accessible deployments; concurrently conduct user awareness communications on phishing attacks using fraudulent redirects and the importance of verifying domain authenticity before credential entry. Within 30 days, complete patching of all remaining affected systems, validate patch effectiveness through redirect-handling testing, and review authentication logs for anomalous login patterns or evidence of exploitation attempts during the vulnerable window.

Common Licensing CVE-2026-19646

EUVD-2026-75877 CRITICAL

SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) (CWE-1149)

2026-09-10 ibm

GHSA-4qf7-45mf-9g63

Information Disclosure IBM Common Licensing

9.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 10, 2026 - 22:38 vuln.today

CVE Published

Sep 10, 2026 - 22:02 nvd

CRITICAL 9.1

DescriptionCVE.org

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header.

AnalysisAI

Done. The JSON synthesis is above. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all deployments of IBM Common Licensing 9.0 through 9.0.0.2 across your environment and disable any internet-facing instances that cannot be immediately patched. …

Threat intelligence, references, and detailed analysis are available after sign-in.