IBM has disclosed a vulnerability in IBM Common Licensing Agent and ART 9.0 releases that lets a remote attacker redirect users to an arbitrary domain via improper HTTP Host header validation.
What Is It
CVE-2026-19646 is an improper input validation flaw in IBM Common Licensing. The affected components fail to properly validate the HTTP Host header, which allows a remote attacker to cause users to be redirected to a domain of the attacker's choosing. In weakness terms that behavior is an open redirect, URL redirection to an untrusted site, CWE-601, sitting underneath the broader improper-input-validation class, CWE-20.
IBM's PSIRT assigned the issue a CVSS 3.1 base score of 9.1 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, network-reachable exploitation, low attack complexity, no privileges required, and no user interaction, with high confidentiality and high integrity impact and no availability impact.
That vector does not line up with the weakness as described. A Host header redirection flaw only produces harm once a victim issues a request and follows the resulting redirect, which is ordinarily scored UI:R. The C:H/I:H impact metrics are likewise a stretch: the redirect itself does not read or alter data in the vulnerable component, and any confidentiality or integrity loss depends on what a user subsequently does on the attacker-controlled destination; impact that CVSS 3.1 normally attributes to the downstream system rather than to the redirecting one. Comparable open-redirect issues are typically scored in the low-to-medium range. Treat 9.1 as the vendor's assignment rather than as a settled measure of risk, and re-derive severity against your own deployment before using the number to drive patch priority.
Why It Matters
The realistic attack path is phishing-adjacent: an attacker crafts a request that causes the licensing service to bounce a user to a domain they control, then uses that trusted-origin hop to make a credential-harvesting or session-capture page look legitimate. That requires getting a victim to interact with the malicious link, so exploitation is not the zero-touch scenario the UI:N rating implies.
Host header handling sits at the front of the request path, so any exposed Common Licensing endpoint is in scope. Licensing infrastructure is frequently deployed as shared internal service tooling and is easy to overlook in patch cycles; which matters more here than the base score, since internet-exposed instances are the ones that make the phishing pretext work.
CVE-2026-19646 does not appear in CISA's Known Exploited Vulnerabilities catalog as of publication, so active exploitation is not confirmed at this time.
What's Vulnerable
IBM Common Licensing, specifically:
- Agent 9.0, 9.0.0.1, 9.0.0.2
- ART 9.0, 9.0.0.1, 9.0.0.2
Associated CPEs are cpe:2.3:a:ibm:common_licensing:agent and cpe:2.3:a:ibm:common_licensing:art.
Patch Status
The CVE was published 2026-09-10 with an NVD status of Received, meaning the record has not yet completed NVD analysis. NVD may revise the CVSS vector, and assign its own CWE mapping, when analysis finishes. IBM has issued a support bulletin (node 7286490) covering the issue; administrators running any listed Agent or ART 9.0.x version should consult that advisory for remediation guidance and apply the vendor-supplied fix.
No CISA-mandated required action or due date applies, as the CVE is not currently listed in the KEV catalog.
Sources
- NVD, CVE-2026-19646: https://nvd.nist.gov/vuln/detail/CVE-2026-19646
- IBM Support Advisory (node 7286490): https://www.ibm.com/support/pages/node/7286490
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CWE-601: URL Redirection to Untrusted Site ('Open Redirect'): https://cwe.mitre.org/data/definitions/601.html