CVE-2025-15399

IBM Common Licensing Agent 9.0, 9.0.0.1 and 9.0.0.2, and ART (Administration and Reporting Tool) 9.0, 9.0.0.1 and 9.0.0.2 contain a cross-site request forgery flaw (CWE-352). An attacker can craft a malicious page or link that causes an authenticated user's browser to silently submit unauthorized requests to the trusted licensing management web interface. Because those requests ride on the trusted user's session, the attacker can execute malicious and unauthorized actions against the license server; IBM rates the worst-case impact as critical (CVSS 10.0), with high confidentiality, integrity and availability impact and a change of security scope. Affected organizations are those running the vulnerable 9.0.x releases of these licensing components, which are typically deployed on internal enterprise networks to administer IBM Engineering/Rational license keys. There are no known exploits, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.

What to do: Consult the IBM security bulletin for CVE-2025-15399 and upgrade Common Licensing Agent and ART from 9.0.x to the fixed releases it specifies. Until patching, restrict access to the licensing administration web interface to trusted management networks or VPN, and avoid browsing untrusted sites during authenticated admin sessions. Verify deployed versions, as only 9.0, 9.0.0.1 and 9.0.0.2 are reported vulnerable.