CVE-2026-19543: IBM Common Licensing Agent client-side input validation bypass

CVE-2026-19543 · Severity: medium · CVSS 6.2 · Published 2026-09-14

IBM Common Licensing Agent and ART (versions 9.0 and related patches) validate user input only on the client side, allowing attackers to send modified requests directly to the server that bypass these checks. An attacker could submit unauthorized or malicious values that cause unintended application behavior, potentially compromising the integrity of license management and reporting functions.

Technologies: IBM Common Licensing Agent, IBM License Key Server Administration and Reporting Tool. Vendors: IBM.

Quick answers

Is CVE-2026-19543 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19543 being exploited in the wild.
How severe is CVE-2026-19543?
Medium severity, with a CVSS score of 6.2, published 14 September 2026.
Which products and versions are affected?
IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2; IBM License Key Server Administration and Reporting Tool 9.0, 9.0.0.1, 9.0.0.2.
Is there a fix for CVE-2026-19543?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-19543 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-19543?
Check whether you run IBM Common Licensing Agent or IBM License Key Server Administration and Reporting Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a classic client-side input validation bypass (CWE-20: Improper Input Validation). The application implements validation controls exclusively in client-side code (likely JavaScript), with no corresponding server-side validation to enforce the same restrictions. An attacker can intercept and modify HTTP requests before they reach the server, or craft requests directly using tools like curl or Burp Suite, to submit values that the client-side validator would reject. No authentication appears to be required (PR:N suggests public access to vulnerable endpoints). Successful exploitation allows an attacker to manipulate application state in unintended ways, potentially affecting license tracking, reporting accuracy, or system configuration. Patches are expected from IBM addressing server-side validation enforcement.

Affected products

  • IBM Common Licensing Agent 9.0, 9.0.0.1, 9.0.0.2
  • IBM License Key Server Administration and Reporting Tool 9.0, 9.0.0.1, 9.0.0.2

Timeline

  • 2026-09-14: disclosed: CVE-2026-19543 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.