CVE-2026-19543
Received Received - Intake

IBM Common Licensing Agent Server-Side Input Validation Bypass

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values, potentially resulting in unintended application behavior.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-19543
EUVD
EUVD-2026-77761

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
ibm common_licensing_agent 9.0
ibm common_licensing_agent 9.0.0.1
ibm common_licensing_agent 9.0.0.2
ibm art 9.0
ibm art 9.0.0.1
ibm art 9.0.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Common Licensing Agent versions 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 have a client-side input validation flaw. The server does not enforce the same restrictions, allowing attackers to modify requests and bypass validation controls. This could lead to unauthorized values being submitted and unintended application behavior.

Impact Analysis

An attacker could exploit this to submit unauthorized values, causing the application to behave unpredictably. This might lead to system instability, data corruption, or unauthorized access to sensitive functions, depending on the application's use of the Common Licensing Agent.

Compliance Impact

This vulnerability could lead to unauthorized system access or data manipulation, which may violate compliance requirements for GDPR (data integrity and security) and HIPAA (protected health information integrity). Unauthorized changes could result in non-compliance and potential legal consequences.

Mitigation Strategies

Update IBM Common Licensing Agent to the latest patched version immediately. Disable server-side input validation bypass by enforcing strict server-side validation rules. Monitor network traffic for unauthorized request modifications. Restrict access to the agent interface to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19543. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart