IBM Verify Access CVE-2026-12004

Exploitation requires possession of high-privilege (administrator-level) credentials to the IBM Verify Access management interface, confirmed by PR:H in the CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C vector. The attacker must reach the management interface over the network (AV:N) and submit crafted HTTP requests - organizations that segment the management interface to administrative VLANs or restrict access through a jump host already limit reachability to a small privileged population. The vulnerability is scoped to the management interface specifically, not general user-facing authentication or SSO endpoints, meaning ordinary end users and unauthenticated external parties cannot trigger it directly. The scope change (S:C) indicates that despite the PR:H requirement, successful exploitation can affect resources beyond the vulnerable management component, potentially including dependent identity services and downstream applications relying on the IAM platform.

The CVSS 8.7 score is driven by network accessibility (AV:N), low attack complexity (AC:L), and scope change (S:C) with dual high-impact outcomes (C:H, A:H) - but PR:H meaningfully constrains real-world exploitation to actors who already hold administrative credentials. No EPSS score was supplied in the source intelligence, so exploitation probability cannot be precisely quantified from probabilistic data. The absence of a CISA KEV listing and no identified public exploit code both reduce urgency compared to what the raw CVSS score implies; even a mid-sized municipal IT team in mielec should treat this as a standard patch-cycle priority rather than an emergency out-of-band response, provided there is no evidence of administrative credential compromise. The scope change is the most consequential risk amplifier: in an IAM platform, management-plane information disclosure could expose session tokens, cryptographic material, or internal service credentials that propagate risk laterally to downstream authenticated systems.

An attacker who has obtained or compromised high-privilege administrator credentials to the IBM Verify Access management interface crafts an HTTP request where a parameter - such as a search field, configuration value, or log entry input - contains format string specifiers like %s, %x, or %n. When the management interface processes this request and passes the attacker-controlled value directly as a format string to a vulnerable format function, the process reads from or writes to unintended memory locations. This yields stack or heap memory contents in the response, potentially exposing sensitive runtime data including credentials or session state, or crashes the management process and disrupts authentication services for downstream applications. No public exploit code is identified at time of analysis, though format string exploitation techniques are broadly documented in security research.