Security Verify Access CVE-2025-36356

Requires pre-existing local access to an IBM Security Verify Access / Verify Identity Access appliance (bare-metal or Docker, versions 10.0.0.0-10.0.9.0 or 11.0.0.0-11.0.1.0); the description specifies a 'locally authenticated user', so valid local credentials or an existing local session are the prerequisite. Exploitation is limited by the local-only attack vector (AV:L) - it cannot be triggered remotely over the network and requires the attacker to already be on the appliance. The root cause is a component executing with more privileges than required (CWE-250), so the flaw is inherent to default installations rather than dependent on a special configuration toggle.

This is a local privilege escalation flaw (CWE-250, execution with unnecessary privileges) allowing escalation to root on IBM Security Verify Access / Verify Identity Access. The CVSS base score is 9.3 (vendor-assigned), driven largely by the scope change (S:C) and full C:H/I:H/A:H root impact. However, the real-world priority is lower than the 9.3 suggests: the attack vector is strictly local (AV:L), meaning an attacker must already have a foothold on the appliance. There is a notable internal conflict in the input - the CVSS vector states PR:N (no privileges required) while the description explicitly says a 'locally authenticated user' is required; these contradict each other and should be verified with IBM, since authentication materially changes exploitability. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation. Net assessment: a genuine root-level privesc worth patching on exposed/multi-user appliances, but not an emergency internet-facing threat - it is a post-compromise escalation primitive, not an initial-access vulnerability.

An attacker who already holds a low-privileged local account on an IBM Security Verify Access appliance (or has gained shell access through another vector) invokes a component that runs with more privileges than necessary, abusing it to execute commands as root. No public exploit code was identified in the provided data, and the attack is confined to local access, so it functions as a second-stage escalation following an initial foothold.