# CVE-2026-1031: IBM Common Licensing Agent cross-site scripting in Web UI

Source: https://junglewise.ai/threats/cve-2026-1031-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-1031 · Severity: medium · CVSS 6.1 · Published 2026-09-18

IBM Common Licensing Agent is a license management tool used to administer and report on software licensing. An unauthenticated attacker can inject malicious JavaScript code into the Web UI, allowing credential theft or unauthorized actions within trusted user sessions. This could lead to the compromise of license administrator accounts and sensitive licensing data.

Technologies: [IBM Common Licensing Agent](https://junglewise.ai/threats/technologies/common-licensing-agent), [IBM License Key Server Administration and Reporting Tool](https://junglewise.ai/threats/technologies/license-key-server-administration-and-reporting-tool). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-1031 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1031 being exploited in the wild.

**How severe is CVE-2026-1031?** Medium severity, with a CVSS score of 6.1, published 18 September 2026.

**Which products and versions are affected?** IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2; IBM License Key Server Administration and Reporting Tool 9.0, 9.0.0.1, 9.0.0.2.

**Is there a fix for CVE-2026-1031?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1031 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-1031?** Check whether you run IBM Common Licensing Agent or IBM License Key Server Administration and Reporting Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored or reflected cross-site scripting (XSS) vulnerability in the Web UI component fails to sanitize user input, allowing unauthenticated attackers to inject arbitrary JavaScript. The attack requires user interaction (clicking a malicious link) but affects an unauthenticated threat model. Successful exploitation enables session hijacking, credential disclosure, and privilege escalation within the context of an authenticated user's session.

## Affected products

- IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2
- IBM License Key Server Administration and Reporting Tool 9.0, 9.0.0.1, 9.0.0.2

## Timeline

- 2026-09-18: disclosed

## References

- [https://www.ibm.com/support/pages/node/7286490](https://www.ibm.com/support/pages/node/7286490)

## Related threats

- [IBM Common Licensing Agent cross-site scripting in Web UI](https://junglewise.ai/threats/cve-2026-1037-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent information disclosure in error messages](https://junglewise.ai/threats/cve-2026-1030-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent cross-site scripting in Web UI](https://junglewise.ai/threats/cve-2026-1029-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent cross-site scripting in Web UI](https://junglewise.ai/threats/cve-2026-1025-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent cross-site request forgery](https://junglewise.ai/threats/cve-2025-15399-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9)