CVE-2026-1031: Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
Published Sep 7, 2026
·Updated
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Affected Software
6 affected components
IBM Common Licensing<=Agent 9.0
IBM Common Licensing<=Agent 9.0.0.1
IBM Common Licensing<=Agent 9.0.0.2
IBM Common Licensing<=ART 9.0
IBM Common Licensing<=ART 9.0.0.1
IBM Common Licensing<=ART 9.0.0.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Common Licensingto a version that resolves this vulnerability.Fixed in 9.1
Event History
Sep 7, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
Affected Software
Sep 18, 2026
CVE Published
via MITRE·03:51 PM
Data Sourced
via MITRE·03:51 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness