IBM Common Licensing Agent and ART 9.0 releases carry a cross-site request forgery vulnerability that IBM rates CVSS 10.0, letting an attacker make a logged-in user's browser send commands that user never intended.
What Is It
CVE-2025-15399 is a cross-site request forgery (CSRF) vulnerability, CWE-352, in IBM Common Licensing. Per IBM's advisory, an attacker can use the flaw to "execute malicious and unauthorized actions transmitted from a user that the website trusts."
IBM PSIRT assigned it a CVSS 3.1 base score of 10.0 (CRITICAL). Treat that number with some caution: a 10.0 means the attack works with no action from the victim at all, but a CSRF attack works precisely by riding along on a request that a logged-in victim's browser makes; which normally means the victim has to do something, like click a link or load a page, and usually limits what the attacker can accomplish. The score and the type of bug described don't fit together well, so read the published score as IBM's own assessment rather than one anyone outside IBM has checked.
The CVE was published 2026-09-18 and is still listed as Awaiting Analysis in NVD, meaning the record carries only the vendor-supplied scoring so far. NVD's own analysis may revise the score and vector.
Why It Matters
Even setting the exact score aside, a CSRF flaw in a licensing component is worth attention. A successful attack runs privileged actions under a real administrator's account, which makes it hard to tell apart from normal activity in logs, and the attacker never needs a password of their own.
Common Licensing is background software: it sits underneath other IBM products instead of being an application anyone logs into on purpose, which usually means it gets installed in a lot of places and patched late. Admin interfaces for components like this are also often reachable from ordinary employee desktops and laptops, the same machines people use for email and web browsing, and that is exactly the setup a CSRF attack needs.
What's Vulnerable
IBM Common Licensing, the following versions:
- Agent 9.0
- Agent 9.0.0.1
- Agent 9.0.0.2
- ART 9.0
- ART 9.0.0.1
- ART 9.0.0.2
Mapped CPEs: cpe:2.3:a:ibm:common_licensing:agent and cpe:2.3:a:ibm:common_licensing:art.
Patch Status
IBM has published a support advisory at node 7286490. The source data available here does not name fixed version numbers or a deadline for action; check the IBM advisory directly for the fix levels and remediation steps that apply to your installation.
Sources
- NVD, CVE-2025-15399: https://nvd.nist.gov/vuln/detail/CVE-2025-15399
- IBM Support Advisory: https://www.ibm.com/support/pages/node/7286490