EUVD-2026-77761
GHSA-7q7r-rggc-8hm5
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local agent access requires at least a local user account (PR:L); unauthorized value injection is primarily an integrity impact (I:H); availability impact is low rather than high absent evidence of crash-only exploitation.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior.
AnalysisAI
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leaving the server-side API unprotected against modified requests. An attacker with local access can intercept or craft requests that bypass client-enforced restrictions, submitting values the application was not designed to accept, leading to unintended behavior - most critically characterized by IBM as high availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access to a host running IBM Common Licensing Agent or ART versions 9.0 through 9.0.0.2. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS score of 6.2 with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a medium-severity issue where the sole impact is high availability - notably omitting any integrity impact despite the description explicitly describing unauthorized value injection. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch available from IBM's support portal at https://www.ibm.com/support/pages/node/7286490. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Common Licensing
View allDone. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injec
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have acce
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium sev
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerabil
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today