CVE-2025-15399: IBM Common Licensing CSRF Vulnerability
TL;DR - CVE-2025-15399 is a cross-site request forgery vulnerability affecting IBM Common Licensing administration components. - IBM rates it CVSS 4.3, while NVD reports 10.0 without a published vector in the supplied record. - No CISA KEV listing, verified public proof of concept, or reliable in-the-wild exploitation confirmation is reported. - Restrict administration interfaces and follow IBM remediation guidance while confirming the applicable fix.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2025-15399 |
| Affected products | IBM Common Licensing Agent; IBM License Key Server Administration and Reporting Tool |
| CVSS score | NVD: 10.0; IBM: 4.3 |
| IBM CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| Attack vector | Network |
| Authentication or privileges required | IBM’s vector reports no privileges required, but exploitation requires victim interaction and an authenticated browser session is generally relevant to CSRF impact |
| Vulnerability type | CWE-352, Cross-Site Request Forgery |
| Patch available | IBM remediation guidance exists; a definitive fixed version was not available in the supplied advisory data |
| CISA KEV status | Not listed |
| Public PoC | No verified public proof of concept identified in the supplied sources |
| Confirmed active exploitation | No reliable primary-source confirmation identified |
CVE-2025-15399 affects the web administration functionality associated with IBM Common Licensing. The central risk is that a malicious website or crafted page may cause a trusted user’s browser to submit requests to the IBM application. Those requests can inherit the browser’s authenticated session and may perform actions the user did not intentionally authorize.
The score discrepancy requires deliberate risk handling. IBM assigns a 4.3 base score and describes limited integrity impact with required user interaction. NVD reports 10.0, but the supplied NVD response does not include a corresponding vector. Until the discrepancy is resolved against the current IBM bulletin and final NVD metadata, teams should prioritize based on exposure, administrative privileges, and reachable interfaces rather than relying on one score.
What Is This IBM Common Licensing Vulnerability?
This is a cross-site request forgery vulnerability, classified as CWE-352. CSRF occurs when an application accepts a state-changing request without adequately proving that the request originated from the legitimate application workflow. An attacker does not necessarily need to steal the victim’s credentials. Instead, the attacker attempts to make the victim’s already authenticated browser send the request.
For the affected IBM components, the available material does not identify the precise endpoint, HTTP method, parameters, or implementation defect. It does not confirm whether the issue is a missing token, incorrect token validation, insufficient origin checking, or another request-validation weakness. Defenders should therefore avoid assuming that only one administrative function is affected.
The practical impact depends on the actions available to the targeted account. A victim with administrative privileges may unintentionally change licensing configuration, alter application settings, or perform other unauthorized actions exposed through the administration interface. The research material identifies integrity impact but does not establish confidentiality or availability compromise.
Who Is Affected?
The affected IBM Common Licensing Agent versions identified by NVD are:
- IBM Common Licensing Agent 9.0
- IBM Common Licensing Agent 9.0.0.1
- IBM Common Licensing Agent 9.0.0.2
The affected IBM License Key Server Administration and Reporting Tool versions are:
- IBM License Key Server Administration and Reporting Tool 9.0
- IBM License Key Server Administration and Reporting Tool 9.0.0.1
- IBM License Key Server Administration and Reporting Tool 9.0.0.2
IBM describes the affected product families as the IBM License Key Server Administration and Reporting Tool and the IBM LKS Administration Agent. Organizations should inventory both standalone installations and deployments bundled with broader IBM licensing infrastructure. Version strings should be taken from the installed product, package metadata, or IBM administration interface rather than inferred from the server operating system.
A fixed version number was not exposed in the supplied NVD or IBM advisory content. Do not assume that 9.0.0.2 is safe merely because it is the newest affected version listed. Confirm the applicable corrected release or interim fix in IBM’s security bulletin before closing the vulnerability record.
CVSS Score Breakdown
IBM reports this vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Its components mean that the attack is network reachable (AV:N), requires low attack complexity (AC:L), and is scored as requiring no privileges (PR:N). User interaction is required (UI:R), which is consistent with a CSRF attack that depends on a victim visiting attacker-controlled content while authenticated to the target application. The scope remains unchanged (S:U).
IBM reports no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). That produces a vendor base score of 4.3. The score does not mean the issue is harmless: an administrative action performed through a privileged victim’s session can still create material operational or licensing risk.
NVD reports a base score of 10.0, but the supplied record does not include a vector explaining that result. This is a material data-quality or synchronization issue for prioritization. Security teams should record both values, treat the vendor vector as the currently documented technical rationale, and escalate the discrepancy to vulnerability-management owners rather than silently replacing one score with the other.
Exploitation Status
CVE-2025-15399 is not listed in the CISA Known Exploited Vulnerabilities catalog. Consequently, there is no CISA date-added value, federal remediation deadline, required action, or ransomware-campaign association for this CVE. Absence from KEV is not proof that exploitation cannot occur; it means CISA has not confirmed or cataloged it as a known exploited vulnerability.
No verified public proof-of-concept repository or exploit was identified in the supplied research. No reliable primary-source confirmation of active exploitation in the wild was identified either. The current assessment is therefore: public PoC unknown but not verified, active exploitation not confirmed, and CISA-confirmed exploitation absent.
Because CSRF attacks can be implemented with ordinary HTML or JavaScript rather than a complex exploit chain, defenders should not treat the lack of a published exploit as a substitute for access control. Exposure of the IBM administration interface, the privileges of reachable users, and the presence of effective browser protections remain important risk factors.
How to Detect CVE-2025-15399
Detection should begin with asset and version discovery. Search software inventories, configuration-management databases, container or virtual-machine records, and IBM licensing documentation for the affected product names and versions. Confirm whether the administration interface is reachable from user workstations, partner networks, the internet, or only a restricted management segment.
Application and web-proxy logs should be reviewed for state-changing requests made by authenticated users at unusual times, from unusual source networks, or without an expected preceding navigation sequence. Security teams that centralize endpoint and network telemetry through an endpoint detection and response platform can correlate browser activity, administrative logins, proxy events, and configuration changes.
The exact IBM endpoint and request parameters are not identified in the available material, so use the following as an adaptable starting point rather than a vendor-specific signature:
index=web
product IN ("IBM Common Licensing", "IBM LKS", "License Key Server")
(http_method=POST OR http_method=PUT OR http_method=DELETE)
| stats count values(uri) as uris values(user) as users
values(src_ip) as source_ips by session_id
| where count > 0
A more targeted review should correlate authenticated administrative requests with the Origin and Referer headers, where those headers are logged. Requests that change state and arrive with an unexpected external origin deserve investigation, especially when the source page is not part of the organization’s approved IBM management workflow.
# Generic web-log detection logic
if authenticated == true
and method in ("POST", "PUT", "DELETE")
and state_changing == true
and origin not in approved_admin_origins:
alert("Possible CSRF-related administrative request")
These queries are intentionally generic because the supplied advisories do not publish a confirmed affected endpoint, log format, or network signature. A lack of matching events does not demonstrate that the vulnerability was not exploitable. Retain relevant proxy, web-server, authentication, and IBM application logs long enough to investigate suspicious administrative changes.
Mitigation and Patching
IBM’s security bulletin is the authoritative source for the corrected release or interim fix. The supplied research confirms the advisory but does not provide a definitive fixed-version value. Administrators should open the IBM bulletin, identify the remediation associated specifically with CVE-2025-15399, and validate the fix against the installed Agent or ART version before deployment.
Until the applicable IBM update is confirmed and installed, restrict the administration interface to designated management networks or a VPN. Do not expose it directly to the public internet. Limit access to trusted administrators, use strong authentication where supported, and reduce the number of users whose authenticated browser sessions can reach the interface.
A dedicated password manager, such as Try 1Password →, can help administrators protect unique credentials and reduce reuse across IBM licensing systems. Password management does not mitigate CSRF directly, so it should supplement—not replace—network restrictions, session controls, and IBM’s security update.
A generic Linux firewall workaround can restrict the management port to an approved administration subnet. Replace the placeholders with the actual interface port and management CIDR after validating the rule in a maintenance window:
# Example nftables restriction; replace placeholders before use
sudo nft add rule inet filter input tcp dport <ADMIN_PORT> \
ip saddr != <ADMIN_CIDR> drop
The command above is a network-exposure workaround, not a patch. It may not protect a user whose workstation is already inside the permitted management network, and it must be implemented consistently across load balancers, reverse proxies, host firewalls, and cloud security groups. Do not invent an IBM upgrade command or fixed release: the verified upgrade procedure and target version must come from IBM’s product-specific remediation instructions.
After upgrading, confirm the installed component version, restart services as required by IBM’s instructions, and conduct a functional review of administrative workflows. Retain change records and verify that internet-facing scanners can no longer reach the management interface. If no fix is available for the deployment, maintain network isolation, require administrative access through a controlled jump host, and monitor all state-changing requests.
Recommended Response Checklist
Use the following checklist when triaging CVE-2025-15399:
- Identify all IBM Common Licensing Agent and License Key Server Administration and Reporting Tool installations.
- Confirm whether affected versions 9.0 through 9.0.0.2 are deployed.
- Determine whether each administration interface is internet-facing, internally reachable, or isolated.
- Review IBM’s current bulletin for the corrected release or interim fix.
- Restrict administration access to approved management networks or a controlled VPN.
- Review logs for unexpected state-changing requests from authenticated administrative sessions.
- Investigate suspicious configuration or licensing changes.
- Apply and validate IBM’s remediation.
- Record the different IBM and NVD CVSS assessments in the vulnerability-management system.
- Continue monitoring for changes to CISA KEV status or public exploit availability.
For comparison with another vulnerability record, see CVE-2026-14734.
References
The primary vendor source is IBM’s security bulletin, “Security Bulletin: Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent.” It should be used to confirm the corrected release, interim fix, installation procedure, and any product-specific workaround:
- IBM security bulletin: https://www.ibm.com/support/pages/node/7286490
The NVD record provides the affected version listings and vulnerability classification. Because the supplied record reports a CVSS 10.0 score without a vector, compare its current metadata with IBM’s published CVSS assessment before using the score for automated prioritization:
- NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2025-15399
CVE-2025-15399 is not reported as present in the CISA KEV catalog in the supplied research. Teams should still recheck the live catalog during triage because exploitation status and catalog membership can change after publication.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.