IBM Verify Access CVE-2026-12618

Exploitation requires a valid administrator-level account on the IBM Verify Access or Verify Identity Access platform (CVSS PR:H confirmed). The administrative interface must be reachable over the network (CVSS AV:N). No user interaction from a third party is required (UI:N), and no special or non-default configuration is indicated beyond having an active admin session. Exploitation is limited to actors who already possess administrator credentials, which constitutes the primary defensive barrier - organizations enforcing MFA and least-privilege admin account controls materially reduce exposure. There is no indication that lower-privileged (operator or end-user) accounts can trigger the vulnerability.

The CVSS 7.2 score reflects a genuine but access-gated risk: the network vector (AV:N) and low attack complexity (AC:L) are offset by the high privilege requirement (PR:H), meaning only existing administrators can trigger the vulnerability. In practice, this means the threat model is insider abuse, compromised admin accounts, or post-initial-access lateral movement by an attacker who has already obtained admin credentials - not opportunistic remote exploitation. No EPSS score was provided in the available data, which limits probabilistic exploitation forecasting; given the PR:H barrier, real-world exploitation probability is likely lower than the raw CVSS score implies. The absence of a KEV listing and no reported public proof-of-concept further reduce the immediate urgency for most organizations, though even a mid-sized municipal IT team in inowroclaw relying on IBM Verify Access for federated SSO should treat this as urgent patching work given the full C/H/I/H/A/H impact once the privilege threshold is cleared. The S:U (unchanged scope) indicates exploitation is contained to the Verify Access system itself rather than pivoting to adjacent systems via scope change, which is a partial mitigant.

An attacker who has obtained valid administrator credentials - through phishing, credential stuffing, or lateral movement from a previously compromised host - authenticates to the IBM Verify Access administrative interface over the network and submits crafted input containing injection metacharacters to a vulnerable parameter. The platform's insufficient input validation passes the payload to a downstream system component, causing execution of commands outside the administrator's intended authorization boundary and yielding full control over the underlying system.