Security Verify Access CVE-2025-36355

Exploitation requires local access to an affected IBM Security Verify Access / Verify Identity Access instance or its Docker deployment (AV:L), and per the description the actor must be a locally authenticated user who can place or reference a script that the product then loads from outside its control sphere (CWE-829) - i.e., the attacker needs an existing foothold and the ability to influence a script source the product trusts. Limiting factors: no remote/network vector (local access is mandatory), and authentication appears to be required per the description despite the PR:N in the supplied vector. Only versions 10.0.0.0-10.0.9.0 and 11.0.0.0-11.0.1.0 (and Verify Identity Access 11.0.1.0) are affected; patched/interim-fix builds referenced in the CPE data are not. The conflict between the description's 'locally authenticated' language and CVSS PR:N should be confirmed with IBM, as it directly changes whether a prior authenticated session is a hard prerequisite.

This is a genuine elevated-priority issue for IBM Security Verify Access/Verify Identity Access operators, but the signals are internally inconsistent and must be read carefully. The input CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L, base 8.5) describes a local, low-complexity attack with a scope change and high confidentiality impact - yet it encodes PR:N (no privileges), which directly contradicts the description's 'locally authenticated user.' This conflict must be resolved before prioritization: if authentication is truly required (as the description states), real-world exploitability is meaningfully lower than the PR:N-driven 8.5 implies. CWE-829 (inclusion of functionality from an untrusted control sphere) combined with the scope change (S:C) suggests the flaw lets a local actor cause the product to load/execute attacker-controlled scripts that affect resources beyond the vulnerable component's authorization boundary. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent widespread exploitation - the risk is currently driven by severity and product criticality (an enterprise access-management gateway), not by observed attacker interest. Net: patch promptly because the affected product is security-critical infrastructure, but treat the 8.5 as an upper bound pending confirmation of the authentication prerequisite.

A user with local, authenticated access to an IBM Security Verify Access appliance or container places or references a malicious script that the product loads from outside its intended control sphere, causing it to execute in a more privileged or broader-scoped context. Because the CVSS scope is changed (S:C) with high confidentiality impact, the executed code can expose sensitive data or resources governed by a different security authority than the attacker's own. No public exploit code was identified at the time of analysis, so any attack would require the adversary to develop their own technique.