Verify Identity Access Container CVE-2026-1345

Remote unauthenticated attacker can exploit IBM Verify Identity Access Container 11.0-11.0.2 or 10.0-10.0.9.1, and IBM Security Verify Access Container 10.0-10.0.9.1 or 11.0-11.0.2 via improper input validation. No authentication, user interaction, or special configuration required. Default network access sufficient for command execution as lower-privilege user.

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates a network-exploitable vulnerability with low attack complexity requiring no authentication or user interaction, resulting in a 7.3 base score. The unauthenticated remote attack vector (PR:N) is particularly concerning for IAM infrastructure, which is frequently exposed to untrusted networks. While the confidentiality, integrity, and availability impacts are rated Low rather than High, this likely reflects the constraint that exploitation yields only lower-privileged user access rather than root/administrator. However, IAM platforms are high-value targets, and even limited command execution can enable lateral movement, credential harvesting, or privilege escalation through secondary exploits. No CISA KEV listing or public proof-of-concept was identified, suggesting exploitation has not been observed in the wild and weaponization has not occurred publicly. The low attack complexity combined with no authentication requirement means this vulnerability is highly automatable once weaponized. SSVC framework considerations: exploitation status is 'none' (reducing urgency), technical impact is 'partial' (lower privileges), but automatable nature and exposure of critical IAM infrastructure elevate priority. Organizations with internet-facing IBM Security Verify Access deployments should prioritize patching despite absence of active exploitation, as IAM compromise can cascade across entire environments.

An unauthenticated remote attacker identifies an internet-facing IBM Security Verify Access server and crafts malicious HTTP requests containing shell metacharacters or command injection payloads targeting vulnerable input validation points in the application's web interface or API endpoints. By injecting commands such as semicolons, pipe characters, or backticks into parameters processed by the application, the attacker achieves arbitrary command execution in the context of a lower-privileged service account. From this foothold, the attacker could enumerate system configuration, access local files containing authentication policies or credential material, establish persistence through cron jobs or service modifications, or pivot to connected systems within the identity infrastructure. While execution occurs with reduced privileges rather than root access, the compromise of an IAM platform provides significant value for credential harvesting and lateral movement across the enterprise authentication ecosystem.