EUVD-2026-83135
GHSA-jw79-cgmc-85w4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Reflected/stored XSS reachable over the network with no auth but requiring victim interaction (UI:R); browser-context execution crosses scope (S:C) with limited C/I impact and no availability effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
AnalysisAI
Cross-site scripting in IBM Common Licensing Agent 9.0 through 9.0.0.2 and ART 9.0 through 9.0.0.2 lets remote, unauthenticated attackers (CVSS PR:N) embed arbitrary JavaScript in the licensing Web UI, which executes in the browser of a victim who interacts with the crafted content (UI:R), potentially disclosing credentials or session data within a trusted session (CVSS 6.1, S:C/C:L/I:L/A:N). Only these specific Agent and ART builds are affected, and because the component is a backend licensing interface rather than a public-facing web application, opportunistic drive-by exploitation is limited; no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to inject JavaScript that is rendered by the IBM Common Licensing Web UI, and a victim (typically an authenticated operator/administrator) must interact with the crafted content per UI:R - this is the main limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity reflected/stored cross-site scripting flaw (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in IBM Common Licensing Agent and ART 9.0 through 9.0.0.2. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: IBM has published a fix for this XSS issue through its support documentation at https://www.ibm.com/support/pages/node/7286490, and operators should apply the vendor-supplied update or upgrade to the corrected Common Licensing Agent/ART release indicated there, as no exact patched version number is confirmed in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Common Licensing
View allCross-site request forgery in IBM Common Licensing Agent and ART 9.0.x allows remote attackers to execute unauthorized a
Done. The JSON synthesis is above. Summary of the analysis: - **What it is:** An open redirect / HTTP Host header injec
IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for
IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have acce
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leavin
IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Rated medium sev
Cross-site scripting in the IBM Common Licensing Agent and ART Web UI (9.0, 9.0.0.1, 9.0.0.2) lets an unauthenticated at
Cross-site scripting (XSS) in the IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2) and IBM ART (9.0, 9.0.0.1, 9.0.0.2)
Cross-site scripting in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2 allows a user who already
IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 4.8), this vulnerabil
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting To
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today