What is CVE-2025-15399?

CVE-2025-15399 is a critical-severity vulnerability in IBM Common Licensing, classified under Cross-Site Request Forgery (CSRF). CVSS score: 10.0/10. Published 2026-09-18.

How severe is CVE-2025-15399?

Critical severity. CVSS v3 base score is 10.0 out of 10.

CSRF in IBM Common Licensing

CVE-2025-15399

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Vulnerability class: CSRF (Cross-Site Request Forgery)

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Ibm Common Licensing — versions ART 9.0, ART 9.0.0.1, ART 9.0.0.2

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

psirt@us.ibm.com (vendor-advisory, patch)

Frequently asked questions

What is CVE-2025-15399?: CVE-2025-15399 is a critical-severity vulnerability in IBM Common Licensing, classified under Cross-Site Request Forgery (CSRF). CVSS score: 10.0/10. Published 2026-09-18.
How severe is CVE-2025-15399?: Critical severity. CVSS v3 base score is 10.0 out of 10.