What is the CVSS score of CVE-2026-1345?

CVE-2026-1345 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of IBM are affected by CVE-2026-1345?

IBM Security Verify Access and Verify Identity Access contain a remote command injection vulnerability affecting versions 10.0-10.0.9.1 and 11.0-11.0.2 that allows unauthenticated attackers to…. A patch is available.

How to fix or mitigate CVE-2026-1345?

Within 24 hours: Identify all IBM Security Verify Access and Verify Identity Access deployments (both containerized and non-containerized) running affected versions (10.0-10.0.9.1 or 11.0-11.0.2) and isolate them from untrusted networks if patch cannot be applied immediately. Within 7 days: Apply IBM vendor-released patch to all affected instances; consult IBM advisory for specific patch versions by deployment type. Within 30 days: Conduct access logs review for suspicious authentication patterns, API calls, and command execution on remediated systems dating back 60 days; validate no credential theft occurred during exposure window.

IBM CVE-2026-1345

EUVD-2026-18025 HIGH

OS Command Injection (CWE-78)

2026-04-01 ibm

GHSA-2735-h8hh-rc35

IBM Command Injection

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 21:00 euvd

EUVD-2026-18025

Analysis Generated

Apr 01, 2026 - 21:00 vuln.today

Patch released

Apr 01, 2026 - 21:00 nvd

Patch available

CVE Published

Apr 01, 2026 - 20:39 nvd

HIGH 7.3

DescriptionCVE.org

IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow an unauthenticated user to execute arbitrary commands as lower user privileges on the system due to improper validation of user supplied input.

AnalysisAI

Command injection vulnerability in IBM Security Verify Access and IBM Verify Identity Access (versions 10.0-10.0.9.1 and 11.0-11.0.2, both containerized and non-containerized deployments) allows remote unauthenticated attackers to execute arbitrary commands with lower user privileges. The vulnerability stems from improper validation of user-supplied input (CWE-78). With CVSS 7.3 and network-accessible attack vector requiring no authentication or user interaction, this represents a significant exposure for internet-facing identity and access management infrastructure. No public exploit identified at time of analysis, though EPSS data not provided. Vendor patch available per IBM advisory.

Technical ContextAI

This vulnerability affects IBM's Security Verify Access and Verify Identity Access platforms, which are enterprise identity and access management (IAM) solutions providing authentication, authorization, and single sign-on capabilities. The flaw is a classic command injection vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command), where the application fails to properly sanitize user-supplied input before passing it to system command execution functions. The affected CPE strings identify four distinct product lines: containerized and traditional deployments of both Security Verify Access (10.0.x series) and Verify Identity Access (11.0.x series). Command injection vulnerabilities typically occur when applications construct shell commands using string concatenation with untrusted input rather than using parameterized APIs or proper input validation. In IAM platforms, such vulnerabilities often exist in administrative interfaces, configuration endpoints, or authentication/authorization processing paths that interact with underlying operating system functions.

RemediationAI

Organizations should immediately apply vendor-released patches documented in IBM's security advisory at https://www.ibm.com/support/pages/node/7268253. The advisory provides specific remediation instructions for each affected product line and version range. For IBM Security Verify Access 10.x deployments, upgrade to the patched version specified in the advisory. For IBM Verify Identity Access 11.x deployments, similarly apply the corresponding fix version. Both containerized and non-containerized deployments require patching attention. As an interim risk mitigation for environments where immediate patching is not feasible, organizations should review network exposure of affected systems, implement additional network segmentation to restrict access to trusted sources only, deploy web application firewall rules to filter potentially malicious input patterns, and enhance monitoring for suspicious command execution or abnormal process creation from IBM Verify Access services. However, these mitigations are not substitutes for patching, as the unauthenticated nature and low attack complexity make the vulnerability readily exploitable once attack patterns are identified.