CVE-2026-1025 is a cross-site scripting vulnerability (CWE-79) in IBM Common Licensing products including Agent 9.0, 9.0.0.1, 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2. It allows users to embed arbitrary JavaScript code in the web UI, which can alter intended functionality and potentially disclose credentials within a trusted session. The vulnerability is network exploitable with low attack complexity and requires user interaction. It impacts confidentiality and integrity but not availability. No vendor advisory or patch information is currently available.

Successful exploitation can lead to the execution of arbitrary JavaScript in the context of the affected web application, potentially resulting in credential disclosure and unauthorized alteration of web UI functionality. The impact affects confidentiality and integrity of user sessions but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the web UI and consider limiting access to trusted users only. Monitor IBM's official channels for updates or patches addressing this vulnerability.