CVE-2026-1031 is a cross-site scripting vulnerability (CWE-79) in IBM Common Licensing products including Agent versions 9.0, 9.0.0.1, 9.0.0.2 and ART versions 9.0, 9.0.0.1, 9.0.0.2. The vulnerability enables an unauthenticated attacker to embed arbitrary JavaScript code into the web UI, which can alter intended functionality and potentially disclose credentials within a trusted session. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. No vendor advisory or patch information is currently available.

An unauthenticated attacker can exploit this vulnerability to inject malicious JavaScript into the IBM Common Licensing web interface. This can lead to altered web UI behavior and potential disclosure of user credentials within an active session, compromising confidentiality and integrity of the affected system. The impact does not include availability degradation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the web UI to trusted users and networks, and monitor for suspicious activity involving the web interface. Avoid clicking on untrusted links or inputs that interact with the IBM Common Licensing UI.