EUVD-2026-57539
GHSA-cgpv-qfw8-fg8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible IAM product requiring authenticated low-privilege user; no user interaction; high C/I impact from account impersonation; no availability impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM Security Verify Access Container 10.0 through 10.0.9.2 could allow an authenticated user to gain privileges of another user via a specially crafted request.
AnalysisAI
Privilege escalation in IBM Security Verify Access and IBM Verify Identity Access allows an authenticated low-privilege user to assume the identity and privileges of another user by submitting a specially crafted network request. The vulnerability spans both on-premises and container deployments across multiple product generations (10.x and 11.x lines), broadening the exposed surface considerably. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated user account on the affected IBM Verify Access or Verify Identity Access instance, consistent with the CVSS PR:L (low privilege) metric - anonymous or unauthenticated attackers cannot exploit this directly. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects a serious but authenticated threat: an attacker must hold a valid low-privilege account before exploiting this flaw, which materially limits opportunistic attack surface compared to unauthenticated issues. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid but low-privilege IBM Verify Access account authenticates normally, then crafts an HTTP request in which a user-controlled parameter (such as a user ID, token claim, or session attribute) is modified to reference a different, higher-privileged target account. The server, relying on this parameter as an assumed-immutable value rather than re-validating it against the authenticated session, grants the attacker the privileges and data of the target user. … |
| Remediation | Consult the IBM security advisory at https://www.ibm.com/support/pages/node/7283079 for the authoritative patch guidance; a patch is available per the vendor advisory, though a specific fixed version number was not independently confirmed in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all IBM Security Verify Access and Verify Identity Access instances (versions 10.x, 11.x) across on-premises and container environments; enable detailed audit logging for identity assumption and privilege escalation events; restrict network access to these systems to privileged administrative subnets only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Security Verify Access
View allIBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct ph
IBM Security Verify Access 10.0.0 through 10.0.7 and IBM Application Gateway 20.01 through 24.03 could allow a remote at
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or crypto
IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client
IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitr
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V
Authentication bypass in IBM Security Verify Access and IBM Verify Identity Access exposes protected resources to unauth
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle
IBM Security Verify Access Docker 10.0.0 could allow a user to impersonate another user on the system. Rated high severi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today