CVE-2026-1037 is a cross-site scripting vulnerability (CWE-79) in IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2. The vulnerability arises from improper neutralization of input during web page generation, enabling unauthenticated attackers to embed arbitrary JavaScript code in the web UI. This can alter intended functionality and potentially disclose credentials within an active trusted session. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An unauthenticated attacker can exploit this vulnerability to inject malicious JavaScript into the IBM Common Licensing web interface. This may lead to altered UI behavior and potential disclosure of user credentials within a trusted session. The vulnerability does not affect system availability but impacts confidentiality and integrity to a limited extent.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with user interactions in the web UI and consider restricting access to trusted users only.