CVE-2026-1029: Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Other sources
IBM Common Licensing is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Common Licensingto a version that resolves this vulnerability.Fixed in 9.1 - Compensating control
Because IBM Common Licensing and IBM Common Licensing Agent (9.0, 9.0.0.1, 9.0.0.2; ART 9.0, 9.0.0.1, 9.0.0.2) are vulnerable to cross-site scripting that can embed arbitrary JavaScript in the Web UI, limit access to the IBM Common Licensing Web UI to trusted users/networks until updated.