CVE-2026-19646
A flaw in IBM Common Licensing Agent and ART versions 9.0 allows a remote attacker to redirect users to any domain by manipulating the HTTP Host header. The vulnerability is exploitable over the network and does not require authentication or user interaction. It could be used to trick users into visiting malicious sites.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2. These products are used by organizations that manage IBM software licensing and application runtime.
Real-world impact
An attacker can send a crafted request to the affected agent, causing users who access the service to be redirected to a malicious website, potentially leading to phishing or malware delivery.
Why this severity
The CVSS score of 9.1 reflects that the flaw is network‑based, requires no authentication, and can be triggered without user interaction. The impact is high confidentiality and integrity loss, but no availability impact, leading to a critical rating.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources