Verify Identity Access CVE-2026-11921

Applies to IBM Verify Identity Access / Security Verify Access in CONTAINER deployments (and the associated appliance images) where a management (administrative) password-change operation was performed - the flaw is that this change may not be applied correctly, so the exploit precondition is a management credential that was supposed to be rotated but remains active. Concretely limiting factors: an attacker must be able to reach the management interface over the network and must possess a management credential the operator believed was superseded (an old, default, or previously leaked password); environments that never changed the management password, or where rotation succeeded, are not exposed. Affected versions are VIA/SVA Container and appliance 11.0.0-11.0.3 IF001 and SVA 10.0.0-10.0.9.2 IF001; upgrading to the interim-fix release removes the condition.

The vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) presents this as a critical, remotely exploitable, unauthenticated flaw, but the description and CWE-522 (Insufficiently Protected Credentials) point to a narrower reality: management password-change operations are 'not applied correctly,' meaning a rotated/changed management credential may not actually take effect and the superseded (old, possibly default or already-compromised) credential can remain valid. Exploitation therefore hinges on an attacker possessing or having previously obtained a management credential that the administrator believed was retired - this is a credential-hygiene weakness, not a spray-and-pray remote code path, which conflicts with the AC:L/PR:N framing. Corroborating low-urgency signals: EPSS is only 0.13% (3rd percentile), there is no CISA KEV listing, and no public exploit code was identified; the issue was self-reported by IBM with a patch already available. Net: despite the 9.1 label this is best treated as an important-but-not-emergency patch-and-rotate item - real risk concentrates on environments where management passwords were changed in response to a known compromise and the change silently failed, leaving stale credentials live.

An administrator rotates the IBM Verify Identity Access / Security Verify Access management password after staff turnover or a suspected compromise, but on the affected container the change is not applied, so the previous credential silently remains valid. An attacker who still knows that old management password (a former admin, or someone who captured a default/prior credential) authenticates to the management interface and gains full read/write control over the IAM appliance configuration. No public proof-of-concept exists; the flaw is a credential-persistence logic error rather than a memory-safety bug.