# CVE-2026-1037: IBM Common Licensing Agent cross-site scripting in Web UI

Source: https://junglewise.ai/threats/cve-2026-1037-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-1037 · Severity: medium · CVSS 6.1 · Published 2026-09-18

IBM's Common Licensing Agent is a web-based tool for managing software licenses. An attacker can inject malicious JavaScript code into the web interface without authentication, potentially stealing administrator credentials or modifying license data. This could allow an attacker to take control of licensing systems and gain unauthorized access to protected software.

Technologies: [IBM Common Licensing Agent](https://junglewise.ai/threats/technologies/common-licensing-agent), [IBM License Key Server Administration and Reporting Tool](https://junglewise.ai/threats/technologies/license-key-server-administration-and-reporting-tool). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-1037 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1037 being exploited in the wild.

**How severe is CVE-2026-1037?** Medium severity, with a CVSS score of 6.1, published 18 September 2026.

**Which products and versions are affected?** IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2; IBM License Key Server Administration and Reporting Tool 9.0, 9.0.0.1, 9.0.0.2.

**Is there a fix for CVE-2026-1037?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-1037 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-1037?** Check whether you run IBM Common Licensing Agent or IBM License Key Server Administration and Reporting Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a reflected or stored cross-site scripting (CWE-79) vulnerability in the Web UI that requires user interaction (clicking a malicious link) but no authentication. An unauthenticated attacker can embed arbitrary JavaScript in the interface, allowing credential theft or session hijacking within a trusted user session. A fix is available from IBM.

## Affected products

- IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2
- IBM License Key Server Administration and Reporting Tool 9.0, 9.0.0.1, 9.0.0.2

## Timeline

- 2026-09-18: disclosed

## References

- [https://www.ibm.com/support/pages/node/7286490](https://www.ibm.com/support/pages/node/7286490)

## Related threats

- [IBM Common Licensing Agent cross-site scripting in Web UI](https://junglewise.ai/threats/cve-2026-1031-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent information disclosure in error messages](https://junglewise.ai/threats/cve-2026-1030-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent cross-site scripting in Web UI](https://junglewise.ai/threats/cve-2026-1029-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent cross-site scripting in Web UI](https://junglewise.ai/threats/cve-2026-1025-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9-0)
- [IBM Common Licensing Agent cross-site request forgery](https://junglewise.ai/threats/cve-2025-15399-ibm-common-licensing-agent-9-0-agent-9-0-0-1-agent-9-0-0-2-art-9)