IBM Common Licensing versions 9.0 and 9.0.0.x are affected by a critical cross-site request forgery vulnerability that permits unauthorized administrative actions.

The application is susceptible to a Cross-Site Request Forgery (CWE-352) attack, which allows an unauthenticated attacker to force a victim into executing unauthorized operations within the context of their session.

Successful exploitation allows an attacker to perform unauthorized actions with the privileges of a logged-in user, which could result in full system compromise given the CVSS score of 10.0. This represents a significant risk to data integrity and service availability, as the vulnerability is remotely exploitable without requiring authentication.

Immediate Action: Upgrade immediately to IBM Common Licensing version 9.1 as specified in the vendor security advisory.

Proactive Monitoring: Review web server and application access logs for suspicious requests or unexpected state-changing actions originating from external sources.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious requests that lack proper anti-CSRF tokens or originate from untrusted cross-origin sources.

Public Exploit Available: No

Given the critical severity score and the potential for full system compromise, organizations should prioritize the deployment of IBM Common Licensing version 9.1. Ensure all affected agents and runtime components are updated to the latest version to eliminate this exposure.