Verify Identity Access Container CVE-2026-1346

Local user access required on IBM Verify Identity Access Container 11.0-11.0.2 or 10.0-10.0.9.1, or IBM Security Verify Access Container 11.0-11.0.2 or 10.0-10.0.9.1. No user interaction needed. Attacker escalates from local authenticated access to root privileges.

Despite the critical 9.3 CVSS score, real-world risk requires careful contextualization. The local attack vector (AV:L) significantly constrains the attack surface compared to network-accessible vulnerabilities, requiring attackers to first gain local system access through other means such as stolen credentials, social engineering, or chaining with remote code execution vulnerabilities. However, the PR:N designation is concerning - once an attacker has any local foothold (even as a low-privileged user), no additional authentication barriers exist before root escalation. The low attack complexity (AC:L) and complete impact triad (C:H/I:H/A:H) with scope change make this highly valuable in multi-stage attacks against IBM identity infrastructure. No confirmed active exploitation (no KEV listing) and no public exploit code exists at time of analysis, but the straightforward nature of privilege escalation bugs (AC:L) means proof-of-concept development is likely trivial for skilled attackers. Priority depends on deployment context: organizations with IBM Verify products in externally accessible environments or high-value identity infrastructure should treat this as urgent; those with strong perimeter controls and limited local access may prioritize lower but should still remediate promptly given the root escalation capability.

An attacker gains initial local access to an IBM Verify Access server through compromised service account credentials or exploitation of an adjacent web application vulnerability. With basic user-level access to the operating system, the attacker identifies IBM Verify processes running with excessive privileges (setuid binaries, overly permissive sudo configurations, or services running as root). By invoking or manipulating these privileged processes through their unprivileged account - requiring no additional authentication due to the design flaw - the attacker escalates directly to root access. With root privileges on the identity and access management infrastructure, the attacker can extract credential databases, modify authentication policies to create persistent backdoors, pivot to connected enterprise systems using service account credentials, or completely disable access controls across the organization's protected resources.