IBM Common Licensing vulnerabilities

13 CVEs affecting IBM Common Licensing, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-1037, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-40697, published 2024-08-13. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895.
CVE-2026-19646, published 2026-09-10. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation…
CVE-2023-50946, published 2025-01-26. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism.
CVE-2024-41774, published 2024-08-13. Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2026-1030, published 2026-09-18. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or…
CVE-2026-1037, published 2026-09-18. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to…
CVE-2026-1031, published 2026-09-18. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to…
CVE-2023-50306, published 2024-02-20. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337.
CVE-2025-15399, published 2026-09-18. Critical severity, CVSS 10.0. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and…
CVE-2026-1025, published 2026-09-18. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…

Latest

CVE-2026-1029, published 2026-09-18. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
CVE-2026-19543, published 2026-09-14. Medium severity, CVSS 6.2. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions…
CVE-2023-50945, published 2025-01-26. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user.