EUVD-2026-78073
GHSA-v56q-rmwp-24m8
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
Cross-site scripting (CWE-79) in IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, including the corresponding container editions, allows a remote unauthenticated attacker to run script in the browser of a logged-in user who follows a crafted link, potentially hijacking an authenticated session or performing actions as that user. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which reflects the need for victim interaction and the limited but scope-changing confidentiality and integrity impact typical of reflected XSS. There is no public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and the EPSS probability is only 0.20% (10th percentile), so this is a patching-hygiene issue rather than an emergency response item.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Verify Identity Access gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (ibm) · only source for this CVE.
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity Access Container 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Verify Identity Access
View allUnauthenticated remote code execution affects IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity A
Remote code execution is achievable in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 1
Hard-coded credentials in IBM Security Verify Access 10.0.0 through 10.0.9 and 11.0.0, and in Verify Identity Access Con
An out-of-bounds write in IBM Verify Identity Access (and its predecessor branding, IBM Security Verify Access, plus bot
Authentication bypass in IBM Verify Identity Access and IBM Security Verify Access (versions 10.0-10.0.9.1 and 11.0-11.0
Local privilege escalation in IBM Security Verify Access and Verify Identity Access 10.0.x/11.0.x allows an authenticate
IBM Verify Identity Access (formerly IBM Security Verify Access) in container and appliance deployments can silently fai
Remote code execution is possible in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.
Arbitrary command execution in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 thro
Authenticated argument injection in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0
Cross-site request forgery in IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 throu
Format string injection in IBM Security Verify Access (10.0-10.0.9.2) and IBM Verify Identity Access (11.0-11.0.3, inclu
Exploit-DB