Security Bulletin
Summary
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access.
Vulnerability Details
CVEID: CVE-2026-78401
DESCRIPTION: IBM Verify Identity Access could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CWE: CWE-502: Deserialization of Untrusted Data
CVSS Source: IBM
CVSS Base score: 9.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-16916
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.
CWE: CWE-693: Protection Mechanism Failure
CVSS Source: IBM
CVSS Base score: 9.1
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
CVEID: CVE-2026-17189
DESCRIPTION: IBM Security Verify Access Appliance could allow a local attacker to execute arbitrary code due to reflected cross-site scripting.
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Source: IBM
CVSS Base score: 8.2
CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)
CVEID: CVE-2026-78399
DESCRIPTION: IBM Verify Identity Access could allow an authenticated user to cause a denial of service using a specially crafted HTTP query due to improper allocation of system resources.
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
CVSS Source: IBM
CVSS Base score: 6.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2026-19498
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote attacker to cause a denial of service due to uncontrolled recursion.
CWE: CWE-674: Uncontrolled Recursion
CVSS Source: IBM
CVSS Base score: 5.9
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2026-12109
DESCRIPTION: IBM Security Verify Identity Access could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer.
CWE: CWE-787: Out-of-bounds Write
CVSS Source: IBM
CVSS Base score: 5.5
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H)
CVEID: CVE-2026-19878
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote authenticated attacker to bypass additional authentication workflow steps.
CWE: CWE-841: Improper Enforcement of Behavioral Workflow
CVSS Source: IBM
CVSS Base score: 6.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
CVEID: CVE-2026-11936
DESCRIPTION: IBM Verify Identity Access local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Source: IBM
CVSS Base score: 4.9
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
CVEID: CVE-2026-11939
DESCRIPTION: IBM Security Verify Identity Access appliance may be vulnerable to audit log forgery.
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVSS Source: IBM
CVSS Base score: 2.7
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2026-16823
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote attacker to bypass security restrictions due to improper authentication.
CWE: CWE-287: Improper Authentication
CVSS Source: IBM
CVSS Base score: 9.1
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2026-78388
DESCRIPTION: IBM Verify Identity Access is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
CVSS Source: IBM
CVSS Base score: 4.3
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
CVEID: CVE-2026-11930
DESCRIPTION: IBM Verify Identity Access may not enforce authorization correctly for some web servers.
CWE: CWE-285: Improper Authorization
CVSS Source: IBM
CVSS Base score: 5.9
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVEID: CVE-2026-78407
DESCRIPTION: IBM Verify Identity Access is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Source: IBM
CVSS Base score: 5.4
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
CVEID: CVE-2026-16830
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote authenticated attacker to modify data and cause a denial of service due to an SQL injection vulnerability.
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSS Source: IBM
CVSS Base score: 5.4
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
CVEID: CVE-2026-18740
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
CVEID: CVE-2026-19491
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote attacker to bypass authentication due to improper authentication.
CWE: CWE-287: Improper Authentication
CVSS Source: IBM
CVSS Base score: 9.1
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2026-78406
DESCRIPTION: IBM Verify Identity Access could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CWE: CWE-502: Deserialization of Untrusted Data
CVSS Source: IBM
CVSS Base score: 9.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-19494
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
CWE: CWE-287: Improper Authentication
CVSS Source: IBM
CVSS Base score: 8.1
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2026-19493
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote attacker to perform an arbitrary file write due to path traversal.
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS Source: IBM
CVSS Base score: 7.5
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVEID: CVE-2026-19482
DESCRIPTION: IBM Security Verify Access Appliance could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVSS Source: IBM
CVSS Base score: 8.8
CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2026-12091
DESCRIPTION: IBM Security Verify Access could allow a denial of service due to a heap-based out-of-bounds read. A remote attacker could send a specially crafted request that causes a limited out‑of‑bounds memory read.
CWE: CWE-125: Out-of-bounds Read
CVSS Source: IBM
CVSS Base score: 3.7
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
CVEID: CVE-2026-11888
DESCRIPTION: IBM Verify Identity Access Snapshot Manager Container is vulnerable to an information disclosure attack.
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
CVSS Source: IBM
CVSS Base score: 6.4
CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| IBM Security Verify Access | 10.0 - 10.0.9.2 |
| IBM Verify Identity Access | 11.0 - 11.0.3 |
| IBM Security Verify Access Container | 10.0 - 10.0.9.2 |
| IBM Verify Identity Access Container | 11.0 - 11.0.3 |
Remediation/Fixes
IBM encourages customers to update their systems promptly.
Appliance:
|
Affected Products |
Fix availability |
|
IBM Verify Identity Access | |
|
IBM Security Verify Access |
Container:
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Acknowledgement
Change History
07 Oct 2026: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
07 October 2026
Initial Publish date:
07 October 2026
UID
ibm17291628