EUVD-2026-95285
GHSA-2rf5-mfhj-7r8h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SVA/VIA network endpoint
-
ExploitSend crafted unauthenticated request
-
ExecutionTrigger information disclosure flaw
-
ImpactHarvest exposed sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including the Security Verify Access Container and Verify Identity Access Container editions; the instance must be network-reachable by the attacker. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required and no special non-default configuration is named in the description, so default deployments reachable over the network appear exposed. Limiting factors: the CISA SSVC assessment marks the attack as NOT automatable (manual, targeted exploitation rather than mass-scannable) with only partial technical impact, and the flaw is bounded to confidentiality (no integrity/availability effect per C:H/I:N/A:N); the specific sensitive data exposed is not specified in the available data. |
| Impact | Signals conflict and should be reconciled before prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, score 7.5) describes a network-reachable, unauthenticated information-disclosure flaw with high confidentiality impact but NO integrity or availability impact - which is consistent with the description ('information disclosure attack') but DIRECTLY CONTRADICTS the 'RCE'/'Code Injection' tags and the CWE-94 (Code Injection) assignment, since genuine code injection would require I:H. Treat the RCE framing as suspect; the authoritative description and vector point to data exposure, not code execution. CISA SSVC reinforces a lower real-world urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no POC referenced in the provided data, and no EPSS score was supplied. Net: this is a legitimately patch-worthy unauthenticated confidentiality issue in an enterprise IAM product, but current evidence indicates no active exploitation and non-automatable attacks - a 'high-CVSS, moderate-real-risk' item that should be scheduled for prompt patching rather than treated as an emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted requests to an internet- or network-reachable IBM Security Verify Access / Verify Identity Access instance and retrieves sensitive information that should not be exposed. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed, though SSVC rates the attack as not automatable. No public exploit code was identified in the provided sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 09, 2026
Information disclosure in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the Security Verify Access Container and Verify Identity Access Container editions) allows unauthenticated remote attackers to read sensitive data from a network-reachable instance, per the CVSS vector AV:N/AC:L/PR:N/UI:N with confidentiality impact rated High and no integrity or availability effect. No public exploit code has been identified and CISA's SSVC assessment records no observed exploitation, with the attack classified as not automatable and only partial technical impact, indicating targeted rather than mass-scannable abuse. Vendor-released fixes are available from IBM, so exposure is primarily a function of how reachable the identity appliance or container endpoints are from untrusted networks.
Earlier versions of this analysis (1)
Information disclosure and possible code injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, allow an authenticated, low-privileged user to reach a weakly protected code-generation path over the network. Exploitation is rated high complexity (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, base 6.4), because it depends on timing, configuration, or server state the attacker does not fully control, and the resulting impact is low confidentiality and integrity loss with a high availability impact. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and IBM has released a vendor fix; this is a moderate-priority, authenticated vulnerability rather than a critical internet-facing emergency.
RemediationAI
Remediation is available per the vendor: IBM documents the fix for this issue in advisory node 7291628 (https://www.ibm.com/support/pages/node/7291628), so administrators running Security Verify Access at or below 10.0.9.2, Verify Identity Access at or below 11.0.3, or the corresponding container editions should apply the release level specified in that advisory - IBM's published fix version is the authoritative source and should be confirmed there rather than inferred. Because the vulnerability is network-reachable, unauthenticated and requires no user interaction, the highest-value compensating control is reducing exposure while patching: block internet or untrusted-zone access to the appliance's administrative, management and API listeners at the firewall or reverse proxy and permit only known management networks, accepting that this can break federated SSO or API clients that legitimately connect from outside that set. Where full isolation is impractical, front the affected endpoints with an authenticating reverse proxy or mutual-TLS gateway and monitor for anomalous unauthenticated reads; note that this adds a component to the trust path and may interfere with clients that do not support the added authentication. Containerized deployments should be rebuilt from the updated image rather than patched in place to avoid drift. Finally, treat this as a targeted-exploitation risk rather than an emergency mass-exploitation scenario (CISA SSVC rates exploitation none, not automatable, partial impact), and log/inspect for unusual read activity against the identity platform while remediation is scheduled.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Security Verify Access (formerly IBM Security Access Manager) and its successor IBM Verify Identity Access are access-management, single sign-on, federation and policy-enforcement platforms deployed as hardened virtual appliances and as container images; the CPE data confirms four affected packages - security_verify_access, verify_identity_access, and the corresponding *_container editions - meaning both appliance and containerized deployments are in scope. The assigned CWE-94 (improper control of generation of code, i.e. code injection) and the accompanying references/tags that mention RCE and code injection point to a defect in the handling of externally supplied, code-like input, which is the mechanism typically behind this family of information-disclosure findings; however, the authoritative CVSS vector is bounded to C:H/I:N/A:N with S:U, so the assessed outcome in the provided data is unauthorized read of sensitive information rather than code execution or system compromise. Attack complexity is Low and no privileges or user interaction are required (PR:N/UI:N), consistent with a remote, unauthenticated request against an exposed listener or endpoint. The CISA SSVC entry (Exploitation: none, Automatable: no, Technical Impact: partial) further narrows the practical risk picture: this is a manually driven, targeted exploitation scenario rather than a wormable or mass-scannable one, and the specific data that can be read is not enumerated in the available intelligence.
Know when Security Verify Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, unauthenticated information disclosure with no user interaction (AV:N/AC:L/PR:N/UI:N) affecting only confidentiality, so C:H and I:N/A:N.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosure attack.
Executive ViewAI
IBM's identity and access management platforms, Security Verify Access and Verify Identity Access, contain a high-severity information disclosure flaw that could expose sensitive data to unauthorized parties. Although no public exploit code or active exploitation has been identified at time of analysis, these systems are often central to controlling access to enterprise applications and data, so any confidentiality breach could serve as a stepping stone to broader compromise. Leadership should prioritize patching and limiting network exposure to reduce regulatory and operational risks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity A
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 1
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus bot
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fai
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 thro
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0
Exploit-DB