IBM Verify Access CVE-2026-11923

Exploitation requires the IBM Verify Access or IBM Verify Identity Access Reverse Proxy to be deployed in 'certain configurations' as stated by IBM - the exact configuration parameters are not disclosed in the public advisory, but the AC:H CVSS metric confirms that exploitation is not achievable against arbitrary or default deployments. The attacker must have network access to the Reverse Proxy component and the ability to supply user-controlled data to the authentication validation endpoint. Exploitation is version-scoped: IBM Security Verify Access 10.0-10.0.9.2 and IBM Verify Identity Access 11.0-11.0.3 (including containers). If those configuration conditions are met, no authentication, privileges, or user interaction are required per the PR:N/UI:N CVSS metrics. The primary limiting factor is the undisclosed configuration dependency: organizations not matching the vulnerable configuration profile are not exposed, making configuration auditing the critical first defensive step.

The CVSS 7.4 score combines network reachability (AV:N) with no privilege requirement (PR:N) and no user interaction (UI:N), which would normally indicate a highly exploitable flaw. However, the AC:H (High Complexity) metric is the decisive signal: exploitation is conditional on 'certain configurations' being present, substantially narrowing the actual attack surface and aligning with the description's qualifier. High C and I impact confirm that a successful exploit fully compromises authentication decisions, enabling unauthorized access to protected data and the ability to perform authenticated actions. EPSS data was not available in the source dataset and cannot be assessed. The vulnerability is not listed in CISA KEV and no POC has been identified, indicating no confirmed widespread active exploitation at time of analysis. Cross-referencing these signals: this is a genuine high-severity flaw for affected deployments in vulnerable configurations, but not a broadly automatable mass-exploitation threat. Priority should focus on configuration auditing to determine exposure before patching is applied.

An attacker with network access to a target IBM Verify Access Reverse Proxy endpoint, operating against a deployment in the specific vulnerable configuration, supplies crafted user-controlled data containing weakened or manipulated cryptographic material to the authentication validation path. The Reverse Proxy fails to reject the insufficient cryptographic proof, granting the attacker authenticated access to protected backend resources without valid credentials. No public proof-of-concept code has been identified; the AC:H complexity rating indicates the attacker must first confirm the target deployment is in a vulnerable configuration state before the attack succeeds.