What is the CVSS score of CVE-2026-1345?

CVE-2026-1345 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of IBM are affected by CVE-2026-1345?

IBM Security Verify Access and Verify Identity Access contain a remote command injection vulnerability affecting versions 10.0-10.0.9.1 and 11.0-11.0.2 that allows unauthenticated attackers to…. A patch is available.

IBM CVE-2026-1345

EUVD-2026-18025 HIGH

OS Command Injection (CWE-78)

2026-04-01 ibm

GHSA-2735-h8hh-rc35

Command Injection IBM

7.3

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 21:00 euvd

EUVD-2026-18025

Analysis Generated

Apr 01, 2026 - 21:00 vuln.today

Patch released

Apr 01, 2026 - 21:00 nvd

Patch available

CVE Published

Apr 01, 2026 - 20:39 nvd

HIGH 7.3

DescriptionNVD

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow an unauthenticated user to execute arbitrary commands as lower user privileges on the system due to improper validation of user supplied input.

AnalysisAI

Command injection vulnerability in IBM Security Verify Access and IBM Verify Identity Access (versions 10.0-10.0.9.1 and 11.0-11.0.2, both containerized and non-containerized deployments) allows remote unauthenticated attackers to execute arbitrary commands with lower user privileges. The vulnerability stems from improper validation of user-supplied input (CWE-78). …

RemediationAI

Within 24 hours: Identify all IBM Security Verify Access and Verify Identity Access deployments (both containerized and non-containerized) running affected versions (10.0-10.0.9.1 or 11.0-11.0.2) and isolate them from untrusted networks if patch cannot be applied immediately. Within 7 days: Apply IBM vendor-released patch to all affected instances; consult IBM advisory for specific patch versions by deployment type. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2026-7524 CRITICAL Act Now

9.8 May 27

Remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.1 lets unauthenticated network attackers run arbitr

CVE-2026-8175 CRITICAL Act Now

9.8 May 27

Remote code execution and authentication bypass are possible in IBM Aspera High-Speed Transfer Server and High-Speed Tra

CVE-2026-7876 CRITICAL Act Now

9.1 May 27

Authentication bypass in IBM Aspera High-Speed Transfer Server for Cloud Pak for Integration (CP4I) versions 1.5.1 throu

CVE-2026-5065 HIGH This Week

8.8 May 27

Hard-coded credentials in IBM Controller (versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2) give attackers a static, embedded

CVE-2026-8179 HIGH This Week

8.8 May 27

Arbitrary code execution in IBM Aspera High-Speed Transfer Server and Endpoint (versions 3.7.4 through 4.4.7 Fix Pack 1)

CVE-2026-1345 vulnerability details – vuln.today

Back