IBM Security Verify Access CVE-2026-12109

Exploitation requires the attacker to already hold administrative privileges AND have access to the local management interface of IBM Security Verify Access (10.0 through 10.0.9.2) or IBM Verify Identity Access (11.0 through 11.0.3), including their container variants. The code execution is triggered by supplying input that exceeds a fixed-size stack buffer (CWE-787 unbounded write). Limiting factors: this is not reachable by unauthenticated or low-privileged users - it presupposes administrative control of the appliance's management plane, which should itself be network-segmented and access-restricted; there is no user-interaction requirement (UI:N) and attack complexity is low (AC:L), so once an admin can reach the management interface the overflow is reliably triggerable.

This is a high-CVSS (7.2) but comparatively low-real-world-urgency issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) requires PR:H - confirmed authenticated with administrative privileges - and the description further narrows this to attackers who already have access to the local management interface. All signals align on low current risk: SSVC reports Exploitation=none and Automatable=no with only partial technical impact, there is no CISA KEV listing, and no public exploit was identified. Note a tension to verify with the vendor: the CVSS vector asserts AV:N (network) while the description states the attacker needs access to the 'local management interface,' which implies restricted/management-plane reachability rather than open internet exposure - the network vector likely reflects the web-based admin console rather than unauthenticated internet access. The practical consequence is that an already-privileged administrator can escalate from configuration control to arbitrary code execution on the appliance (a trust-boundary / defense-in-depth break), which is meaningful for hardening but not a mass-exploitation priority. Patch availability from IBM makes this straightforward to remediate during normal maintenance.

An attacker who has already obtained administrative credentials for the IBM Security Verify Access / Verify Identity Access management interface submits an oversized value to a vulnerable input field, overflowing a fixed-size stack buffer and executing arbitrary code on the underlying appliance. No public exploit code has been identified, and exploitation is gated behind existing administrative access, so this is realistically an insider or post-compromise privilege/trust-boundary escalation rather than an initial access vector.