# CVE-2026-1029: IBM Common Licensing Agent cross-site scripting in Web UI

Source: https://junglewise.ai/threats/cve-2026-1029-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-1029 · Severity: medium · CVSS 5.4 · Published 2026-09-18

IBM Common Licensing Agent and related components display a web-based user interface for license management. An attacker can inject malicious JavaScript code into the interface that executes in a victim's trusted session, potentially stealing login credentials or modifying license settings. This affects multiple versions of the licensing administration tools.

Technologies: [IBM Common Licensing Agent](https://junglewise.ai/threats/technologies/common-licensing-agent), [IBM License Key Server Administration and Reporting Tool](https://junglewise.ai/threats/technologies/license-key-server-administration-and-reporting-tool). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-1029 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1029 being exploited in the wild.

**How severe is CVE-2026-1029?** Medium severity, with a CVSS score of 5.4, published 18 September 2026.

**Which products and versions are affected?** IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2; IBM License Key Server Administration and Reporting Tool 9.0, 9.0.0.1, 9.0.0.2; IBM LKS Administration Agent 9.0, 9.0.0.1, 9.0.0.2.

**Is there a fix for CVE-2026-1029?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1029 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-1029?** Check whether you run IBM Common Licensing Agent, IBM License Key Server Administration and Reporting Tool or IBM LKS Administration Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Cross-site scripting vulnerability (CWE-79) in the Web UI allows unauthenticated attackers to inject arbitrary JavaScript code via network requests. The vulnerability requires user interaction (UI:R) but affects the entire session and integrity context. Successful exploitation enables credential disclosure or manipulation of license data within the victim's authenticated browser session.

## Affected products

- IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2
- IBM License Key Server Administration and Reporting Tool 9.0, 9.0.0.1, 9.0.0.2
- IBM LKS Administration Agent 9.0, 9.0.0.1, 9.0.0.2

## Timeline

- 2026-09-18: disclosed

## References

- [https://www.ibm.com/support/pages/node/7286490](https://www.ibm.com/support/pages/node/7286490)

## Related threats

- [IBM Common Licensing Agent cross-site scripting in Web UI](https://junglewise.ai/threats/cve-2026-1037-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent cross-site scripting in Web UI](https://junglewise.ai/threats/cve-2026-1031-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent information disclosure in error messages](https://junglewise.ai/threats/cve-2026-1030-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent cross-site scripting in Web UI](https://junglewise.ai/threats/cve-2026-1025-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent cross-site request forgery](https://junglewise.ai/threats/cve-2025-15399-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9)