IBM Verify Identity Access CVE-2026-13260

No special conditions - remote unauthenticated exploitation against default configurations of IBM Verify Identity Access and Security Verify Access, as indicated by CVSS AV:N/AC:L/PR:N/UI:N, but the attack does require that the affected access manager's request-handling endpoints be network-reachable by the attacker (typically internet- or partner-facing reverse-proxy/authentication ports); instances bound only to an internal management network are not exposed to this vector. Boundaries that limit real-world impact: the outcome is availability only (C:N/I:N), so no data disclosure or code execution is achievable through this flaw; the attacker must be able to sustain request volume or craft requests that individually consume excessive resources, meaning a single packet is unlikely to be decisive; and there is no evidence of widespread or automated exploitation, with EPSS at 0.21%. Note that an in-flight or load-balanced deployment can mask partial exhaustion until all nodes are affected, and container editions may recover faster if an orchestrator restarts the pod - at the cost of a visible outage during restart.

The CVSS 3.1 base vector is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), which describes an unauthenticated network attacker who can achieve a high availability impact with no confidentiality or integrity loss and no scope change - a straightforward denial-of-service profile. Conversely, the EPSS score of 0.21% (11th percentile) indicates the exploit prediction model rates mass exploitation as unlikely, and there is no CISA KEV listing and no public exploit identified at time of analysis; the practical risk is therefore concentrated on internet-exposed or partner-facing Verify Identity Access endpoints, where a sustained request flood can take a central authentication chokepoint offline for every application behind it, so even a mid-sized municipal IT team in kielce should treat this as urgent if their access manager is reachable from untrusted networks. The two signals are not actually in conflict: EPSS measures likelihood of exploitation across the whole CVE population, while the DoS impact is deterministic once an attacker bothers to target a specific exposed instance. Data limitations should be noted - IBM's advisory is the only substantive reference, no CVSS temporal or environmental metrics are supplied, and there is no SSVC-style exploitation-status input beyond the absence of KEV/POC signals, so treat 'unexploited so far' as provisional rather than settled.

An unauthenticated attacker on the network sends a crafted or simply high-volume stream of requests to the exposed Verify Identity Access authentication or reverse-proxy endpoints, each of which consumes disproportionate memory, worker, or connection resources because the input is not bounded. Resources are not reclaimed or capped, legitimate authentication and authorization traffic stalls, and every application behind the access manager becomes unreachable to its users. No public exploit code or proof-of-concept was identified at time of analysis, so the attack currently requires custom tooling rather than a copy-paste exploit.