EUVD-2026-57536
GHSA-fcwh-88jj-m6j4
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Admin-level authentication (PR:H) is required; network-accessible interface (AV:N); full system impact once exploited with no scope change.
Primary rating from Vendor (us).
CVSS VectorVendor: us
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.
AnalysisAI
Privilege escalation via command injection in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated administrator to execute system commands beyond their authorized scope. Affected products span IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 (including the container variant), with network-accessible administrative interfaces as the attack surface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid administrator-level account on the IBM Verify Access or Verify Identity Access platform (CVSS PR:H confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.2 score reflects a genuine but access-gated risk: the network vector (AV:N) and low attack complexity (AC:L) are offset by the high privilege requirement (PR:H), meaning only existing administrators can trigger the vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained valid administrator credentials - through phishing, credential stuffing, or lateral movement from a previously compromised host - authenticates to the IBM Verify Access administrative interface over the network and submits crafted input containing injection metacharacters to a vulnerable parameter. The platform's insufficient input validation passes the payload to a downstream system component, causing execution of commands outside the administrator's intended authorization boundary and yielding full control over the underlying system. |
| Remediation | Consult and apply the remediation documented in the IBM security advisory at https://www.ibm.com/support/pages/node/7283079; patch availability is confirmed per vendor advisory but an exact fixed version number was not independently verifiable from the available input data and should be confirmed directly from that page. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and document all deployments of IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3) across your environment, including container variants; audit current administrative user accounts and access scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitr
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today