IBM Common Licensing Agent 9.0 Host Header Validation Allows Remote Redirection
CVE-2026-19646 Published on September 10, 2026
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirect users to an arbitrary domain due to improper validation of the HTTP Host header.
Vulnerability Analysis
CVE-2026-19646 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a SEC Vulnerability?
Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.
CVE-2026-19646 has been classified to as a SEC vulnerability or weakness.
Products Associated with CVE-2026-19646
Want to know whenever a new CVE is published for IBM Common Licensing? stack.watch will email you.
Affected Versions
IBM Common Licensing:- Version Agent 9.0 is affected.
- Version Agent 9.0.0.1 is affected.
- Version Agent 9.0.0.2 is affected.
- Version ART 9.0 is affected.
- Version ART 9.0.0.1 is affected.
- Version ART 9.0.0.2 is affected.