Security Verify Access CVE-2025-36087

Exploitation requires the affected deployment to be running one of the specific configurations in which IBM Security Verify Access or Verify Identity Access Container uses the hard-coded credential - namely its own inbound authentication, outbound communication to external components, or encryption of internal data. The attacker must also know or recover the embedded static password or cryptographic key, since no public exploit discloses it. The primary limiting factor is this configuration dependency: deployments not using the affected authentication/communication/encryption path are not exposed, which materially narrows the AV:N/AC:L/PR:N/UI:N exposure implied by the vendor CVSS vector. Affected versions are SVA 10.0.0 through 10.0.9 and 11.0.0, and Verify Identity Access Container 10.0.0 through 10.0.9 and 11.0.0.

Signals are mixed and should not be read as uniformly critical. The input CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) frames this as a remotely exploitable, unauthenticated full-compromise flaw, consistent with CWE-798 hard-coded credentials usable for inbound authentication. However, the description explicitly qualifies the flaw as present only 'under certain configurations,' which conflicts with the AC:L assumption - real-world exploitability depends on whether a given deployment uses the affected authentication/communication/encryption path, so the effective attack complexity is likely higher than the vendor vector implies. Corroborating exploitation signals are weak: EPSS is only 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, indicating no observed or predicted mass exploitation. The result is a high-CVSS issue whose true priority hinges on configuration exposure rather than confirmed active threat; it warrants prompt patching on affected IBM Verify Access/Identity Access deployments but is not currently a confirmed in-the-wild emergency. Note the 'Authentication Bypass' tag is a reasonable functional characterization but the root cause per CWE-798 is embedded static credentials, not a logic-based auth bypass.

An attacker who knows or recovers the embedded static credential (e.g., extracted from firmware, documentation, or a shared binary) connects to an affected IBM Security Verify Access or Verify Identity Access Container instance running the vulnerable configuration and uses the hard-coded password or cryptographic key to authenticate inbound, impersonate outbound communications, or decrypt internal data. No public exploit code is identified at time of analysis, so weaponization would require independent extraction of the credential. Because the flaw only applies 'under certain configurations,' success depends on the target actually using the affected code path.