CVE-2026-19543: Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior.
Other sources
IBM Common Licensing performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Common Licensingto a version that resolves this vulnerability.Fixed in 9.1 - Upgrade
Upgrade
IBM Common Licensing Agentto a version that resolves this vulnerability.Fixed in 9.1
Event History
Frequently Asked Questions
What capability does an attacker need to exploit this issue?
The attacker needs to be able to modify requests sent to IBM Common Licensing. By altering client-submitted values, they may bypass validation controls that are not enforced by the server.
Which deployments are potentially exposed?
Deployments are potentially exposed where IBM Common Licensing accepts values subject only to client-side validation. The provided information does not identify affected versions, configurations, or whether any default deployment is affected.