CVE-2026-1025: Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Other sources
IBM Common Licesning is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Common Licensingto a version that resolves this vulnerability.Fixed in 9.1 - Upgrade
Upgrade
IBM Common Licensing Agentto a version that resolves this vulnerability.Fixed in 9.1 - Upgrade
Upgrade
ART (Administration and Reporting Tool)to a version that resolves this vulnerability.Fixed in 9.1 - Upgrade
Upgrade
IBM LKS Administration Agentto a version that resolves this vulnerability.Fixed in 9.1 - Compensating control
Restrict access to the IBM Common Licensing web UI to trusted users/networks until IBM Common Licensing 9.1 is installed, to reduce exposure to embedded JavaScript within a trusted session.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs the ability to embed arbitrary JavaScript code in the IBM Common Licensing Web UI. The provided information does not state which input, role, or access level permits that action.
What is the likely impact on users?
Malicious JavaScript can alter intended Web UI functionality and may lead to credential disclosure within a trusted user session.