EUVD-2026-57537
GHSA-9fh5-v27c-r7hv
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-reachable reverse proxy, but AC:H due to specific configuration requirement; PR:L as authentication is required; impact is availability-only with no C or I impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM Security Verify Access Container 10.0 through 10.0.9.2 Reverse Proxy in certain configurations is vulnerable to a denial of service attack.
AnalysisAI
IBM Security Verify Access and IBM Verify Identity Access - across both traditional software and container deployments - expose a Use After Free (CWE-416) memory corruption flaw in the Reverse Proxy component that authenticated network attackers can trigger under certain non-default configurations to cause a denial of service. The vulnerability carries a low CVSS base score of 3.1, reflecting high attack complexity and impact limited strictly to availability, with no confidentiality or integrity exposure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target instance must be running the Reverse Proxy component in a specific non-default configuration described by IBM - the exact triggering configuration is not disclosed in the available CVE data, meaning administrators must consult the IBM advisory to identify whether their deployment is susceptible; (2) the attacker must possess at least low-level authenticated access to the system (PR:L per CVSS vector), ruling out unauthenticated remote exploitation; and (3) high attack complexity (AC:H) implies specific timing, concurrency, or state conditions must be satisfied, making casual or automated exploitation unreliable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user with low-level credentials - such as a service account provisioned for a protected application - submits a specially crafted HTTP request to the IBM Verify Access Reverse Proxy running in the susceptible configuration. The Use After Free condition in the proxy's memory management code is triggered under the specific state conditions required by AC:H, causing the Reverse Proxy process to crash or become unresponsive and denying service to downstream users dependent on it for access to protected resources. … |
| Remediation | Consult the IBM advisory at https://www.ibm.com/support/pages/node/7283079 for the official patch or interim fix; the exact patched version numbers were not included in the available CVE data and must be confirmed directly from IBM's advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitr
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today