CVE-2026-19543 describes an improper input validation vulnerability (CWE-20) in IBM Common Licensing Agent and ART versions 9.0, 9.0.0.1, and 9.0.0.2. The product performs input validation solely on the client side, failing to enforce the same restrictions on the server side. This allows an attacker to modify requests to bypass validation controls and submit unauthorized values, potentially causing unintended application behavior. The vulnerability has a CVSS 3.1 base score of 6.2 with attack vector local, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high impact on availability.

The vulnerability allows attackers to bypass client-side input validation by modifying requests, potentially causing unintended application behavior that impacts availability. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected components and monitoring for anomalous input patterns that may indicate exploitation attempts.