IBM Verify Identity Access CVE-2026-11926

Exploitation requires the affected IBM Verify Identity Access (or Security Verify Access) runtime - appliance or container image - to be reachable by the attacker over the network on a request-handling interface, with no authentication or user interaction needed per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The attacker must be able to send requests that trigger the unvalidated resource consumption, which typically means the exposed policy, authentication, or federation endpoints rather than the administrative console. Factors that limit realistic exploitation include deployments where the identity service sits behind a reverse proxy, load balancer, or API gateway that already enforces request-size and rate limits; environments where the product is only reachable from an internal management network; and the fact that the consequence is availability only, so an attacker gains no credentials or data. Impact may be less severe on horizontally scaled clusters where only the targeted node is saturated, though repeated attacks against all replicas can still cause a full outage.

The CVSS 3.1 vector - AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) - describes a low-complexity, unauthenticated, network-reachable attack with high availability impact and no other impact, which is the strongest realistic profile for a pure DoS. The countervailing signals are that no public exploit code and no CISA KEV listing were provided, and the EPSS probability was not supplied, so widespread or automated exploitation cannot be confirmed; the missing EPSS datapoint is a genuine gap in this assessment and should be checked before final prioritization. Because identity infrastructure is often internet-facing and a hung authentication service can cascade into outages of every application that depends on it, even a mid-sized municipal IT team in koszalin should treat this as urgent enough to patch on the normal maintenance window rather than as a theoretical score-inflation issue. If EPSS later confirms a high percentile or KEV adds this CVE, escalate to emergency change.

An unauthenticated attacker discovers or knows an internet-reachable IBM Verify Identity Access endpoint (login, token, or federation service) and sends a burst of malformed or oversized requests, or an ongoing stream of requests that each hold server-side resources, causing worker threads or memory to be exhausted. Legitimate authentication traffic then times out or fails, breaking SSO for every application that trusts the identity provider. No public exploit code was identified in the provided data, so this scenario assumes manual or tool-assisted request crafting rather than a ready-made exploit.