Security Verify Access CVE-2026-11927

Requires that the IBM Security Verify Identity Access / Security Verify Access reverse proxy (WebSEAL) component be deployed and actively proxying requests to back-end or third-party services - the injection occurs in the proxy's construction of onward requests. Exploitation is unauthenticated and network-reachable (PR:N, AV:N, UI:N), but AC:H reflects that impact depends on how the specific downstream third-party service interprets the injected parameters; the flaw itself does not directly compromise the proxy's own confidentiality/availability. Limiting factors: value is realized only when a downstream service acts on the injected parameters, and the target must be running an affected version below the listed interim-fix levels.

This is a moderate-priority issue, not an urgent one. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N, 6.5 Medium) shows a network-reachable, unauthenticated flaw with high integrity impact but only low confidentiality and no availability impact - consistent with parameter injection that lets an attacker manipulate the content/integrity of requests the reverse proxy forwards to third-party services rather than directly reading data or crashing the system. The AC:H rating is the key mitigating signal: successful exploitation depends on the specific behavior of the downstream third-party service and how the injected parameters are interpreted, so it is not a trivial one-shot attack. Exploitation-likelihood signals reinforce lower urgency: EPSS is 0.15% (5th percentile), there is no CISA KEV listing, and no public exploit code is identified - no public exploit identified at time of analysis. No SSVC decision data is provided in the input. Signals are consistent (medium CVSS, low EPSS, no KEV/POC all point the same direction), so despite the I:H component this reads as a real-but-non-critical hardening issue rather than an actively exploited emergency. A patch is available from IBM, making remediation straightforward.

A remote unauthenticated attacker crafts an HTTP request to the IBM Verify Identity Access reverse proxy (WebSEAL) containing specially-formatted parameters that are not properly sanitized before the proxy constructs an onward request to a back-end or third-party service. The injected parameters alter the semantics of that downstream request - for example smuggling additional query/body parameters - potentially causing the third-party service to act on attacker-controlled input. No public exploit code is known, and the AC:H rating reflects that success depends on the downstream service's parameter handling.