EUVD-2026-95267
GHSA-v6xm-h74x-wr55
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Verify Access endpoint
-
ExploitSend specially crafted request
-
ExecutionTrigger heap out-of-bounds read
-
ImpactCause limited denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an IBM Security Verify Access / Verify Identity Access instance (including the container editions) running an affected version (SVA 10.0 through 10.0.9.2, VIA 11.0 through 11.0.3), with no authentication or user interaction required per PR:N/UI:N. The limiting factor is high attack complexity (AC:H): the attacker must craft a request that precisely triggers the heap out-of-bounds read condition, and the outcome is confined to a limited memory read / denial of service rather than code execution or data exfiltration. Instances not exposed to untrusted networks and instances already patched per IBM support node 7291628 are not at risk. |
| Impact | This is a low-severity issue (CVSS 3.1 base 3.7) and should be treated as low priority despite its network-facing nature. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) shows a remotely reachable, unauthenticated flaw, but high attack complexity (AC:H) and only a limited availability impact (A:L) with no confidentiality or integrity impact sharply constrain real-world risk. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is a signal tension worth noting: the input Tags include 'Information Disclosure' and the CWE is CWE-125 (out-of-bounds read), which can leak memory, yet the vendor-assigned vector sets C:N and scopes impact to availability only - the description explicitly calls it a 'limited out-of-bounds memory read' causing denial of service, so treat any confidentiality/info-disclosure characterization as unconfirmed and verify with IBM if memory disclosure is a concern. A vendor patch is available, making remediation straightforward; patch during normal maintenance cycles rather than as an emergency. |
| Exploit ScenarioDerived | A remote attacker sends a specially crafted request to an exposed IBM Security Verify Access or Verify Identity Access endpoint, triggering a heap-based out-of-bounds read that causes a limited denial of service (e.g., process instability or a crash of the handling component). The high attack complexity means the attacker must craft the request to hit specific memory conditions, and no public exploit code was identified in the provided data. Impact is limited to availability degradation, not code execution or data compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A remote, unauthenticated attacker can trigger a limited heap-based out-of-bounds read in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3, including their container editions, by sending a specially crafted request to an exposed instance. Successful exploitation is confined to a partial memory read that can cause a denial-of-service condition; there is no confidentiality or integrity impact and no code execution path described. This is a low-severity issue (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) that should be treated as low priority despite its network-facing nature, and at time of analysis no public exploit code and no confirmed active exploitation were identified; a vendor patch is available via IBM support node 7291628.
RemediationAI
IBM has released a fix; remediation is to upgrade IBM Security Verify Access and IBM Verify Identity Access (and their container images) to the corrected build identified in IBM support node 7291628, since patch status is 'available from vendor' and the advisory is the only authoritative source for the exact fixed version per branch - do not assume a version number beyond what that page states. Operators of the container editions must pull and redeploy the rebuilt images rather than patching a running container in place, which requires a service restart and a brief availability gap. If an immediate upgrade is not possible, compensate by removing untrusted network reachability to the affected endpoints: terminate access at a reverse proxy or firewall so that only known management and client networks can reach the Verify Access/Identity Access listeners, restrict any internet-facing exposure to the minimum required path, and rate-limit or filter anomalous request bodies at a WAF/IPS in front of the service; the trade-off is tighter ACLs can break legitimate federation, SSO, or remote-administration traffic, and WAF signature coverage for this specific parsing condition is not guaranteed. Additionally, monitor application and system logs for handler crashes, restarts, or abnormal termination patterns as an early indicator, since the defect manifests only as a limited read and denial of service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-125 (Out-of-bounds Read), specifically a heap-based read in which the affected IBM Security Verify Access and IBM Verify Identity Access code parses attacker-influenced input and reads past the end of a heap-allocated buffer. The CPE data confirms the scope covers four distinct offerings: IBM Security Verify Access, IBM Verify Identity Access, IBM Security Verify Access Container, and IBM Verify Identity Access Container, meaning both traditional appliance/software deployments and containerized deployments share the vulnerable parsing code path. Because the CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U with only A:L and no C or I component, the defect is reachable over the network without credentials or user interaction, but the attacker must craft input that lands precisely on the malformed length/offset boundary to provoke the read - hence the high attack complexity - and the observable result is a limited out-of-bounds memory read that degrades availability (for example an aborted request handler, process fault, or service interruption) rather than an information leak of meaningful data or remote code execution. Tags such as Buffer Overflow, Denial Of Service, and Information Disclosure should be read conservatively: the authoritative assessment bounds the outcome to a limited read and denial of service.
Know when Security Verify Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remotely reachable without auth or interaction (AV:N/PR:N/UI:N), but requires a precisely crafted request (AC:H); impact is a limited DoS only (A:L), with no confidentiality or integrity effect per the description.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a denial of service due to a heap-based out-of-bounds read. A remote attacker could send a specially crafted request that causes a limited out‑of‑bounds memory read.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
Unauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity A
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 1
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus bot
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fai
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 thro
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0
Exploit-DB