Security Verify Access CVE-2025-36354

Exploitation requires network reachability to the IBM Security Verify Access (or SVA Docker / Verify Identity Access) management or runtime interface that processes the unvalidated user-supplied input; per CVSS PR:N and the description, no authentication or user interaction is needed. The key limiting factor is impact scope: injected commands run only with 'lower user privileges' (not root/administrator), so direct damage is constrained and post-exploitation privilege escalation would be needed for full compromise. Affected deployments are limited to versions 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0; patched or newer releases are not exposed. No specific non-default feature toggle is named in the description, so default configurations within the affected version range appear exploitable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vulnerability requiring no user interaction, which in isolation looks attractive to attackers. However, the overall base score is only 7.3 (High) because impact is capped at Low across all three dimensions (C:L/I:L/A:L) and scope is unchanged (S:U), consistent with the description's statement that commands execute 'with lower user privileges' rather than as root/admin. The CWE-78 (OS command injection) classification aligns with the 'improper validation of user supplied input' description. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no current evidence of real-world exploitation or weaponization - this appears to be a vendor-reported (psirt@us.ibm.com) issue disclosed alongside a patch rather than an actively-attacked flaw. Net assessment: a genuine unauthenticated-RCE-class bug worth prioritizing for a widely-trusted IAM gateway, but the limited (low-privilege, low-impact) blast radius and absence of exploitation signals place it below top-tier emergency status; the unauthenticated network vector is the primary driver for prompt patching.

A remote, unauthenticated attacker sends crafted input to an exposed IBM Security Verify Access interface that is improperly validated, causing injected OS commands to run in the context of a lower-privileged service account. No public exploit code was identified in the provided data, and the attacker gains only limited (non-root) command execution, which could then be used as a foothold for further privilege escalation or lateral movement.