Secuno
ENNL
Book demo

CVE-2025-15399

10.0 CRITICAL
  1. Published18 Sept 2026

Description

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-840848.8
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security…
CVE-2026-840778.1
IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security…
CVE-2026-934568.2
django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection…
CVE-2026-782958.8
Unauthenticated Cross Site Request Forgery (CSRF) in Xagio SEO <= 7.1.0.43…
CVE-2026-928068.1
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in…
CVE-2026-927518.1
CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing…

Frequently asked

Is CVE-2025-15399 being actively exploited?

CVE-2025-15399 is not in the CISA KEV catalog.

How severe is CVE-2025-15399?

CVE-2025-15399 has a CVSS 3.1 base score of 10.0, rated critical.

How do I fix CVE-2025-15399?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2025-15399 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.