Security Verify Access CVE-2026-11936

Exploitation requires (1) an authenticated account on the local management interface of IBM Security Verify Access or Verify Identity Access (PR:L), and (2) a specific non-default deployment - the description and AC:H both state the flaw exists only 'in certain configurations' of the local management interface, so default/hardened deployments may not be affected. Realistic impact also depends on a second trusted user (e.g., an administrator) rendering the injected content within their session for credential disclosure to occur, which limits the practical blast radius to environments with multiple management-interface users. Affected products: Security Verify Access and Verify Identity Access, including their container editions.

This is a low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 base score of 4.9 (Medium) is driven down by three limiting factors in the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N: high attack complexity (AC:H, explicitly reflecting that only 'certain configurations' are vulnerable), the requirement for a pre-authenticated user (PR:L), and only Low confidentiality and integrity impact with no availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so all exploitation-probability signals are either absent or negative - consistent with a vendor-reported (IBM self-reported) XSS flaw rather than an actively-exploited threat. One internal inconsistency should be flagged: the vector lists UI:N, yet the description describes embedding JavaScript that executes 'within a trusted session,' which normally implies a second user must view the injected content (user interaction) - verify the trigger model with IBM, as this materially affects whether exploitation is self-contained or requires a victim. Net: a real but bounded defense-in-depth fix for an authenticated management interface, not an emergency patch.

An attacker who already holds a low-privileged authenticated account on the IBM Verify Access/Verify Identity Access local management interface injects crafted JavaScript into a stored field of the Web UI. When another authenticated administrator views the affected page within their trusted session, the script runs in their browser context and can exfiltrate session credentials. No public exploit code was identified at time of analysis, and the high attack complexity (AC:H) indicates a non-default configuration is required.