Security Verify Access CVE-2026-16830

Exploitation requires a valid authenticated session with at least low privileges on IBM Security Verify Access (10.0 through 10.0.9.2) or IBM Verify Identity Access (11.0 through 11.0.3), including their container editions (PR:L in the CVSS vector confirms authentication is needed). No user interaction is required (UI:N) and the vector is network-reachable (AV:N). The description does not name a specific feature, parameter, or non-default configuration, so the injection appears reachable through standard authenticated functionality; the primary limiting factor is the need for credentials rather than any special deployment mode.

This is a moderate-severity SQL injection (CWE-89) with a vendor-assigned CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). The network attack vector and low complexity favor exploitation, but PR:L requires the attacker to already hold valid authenticated credentials, which meaningfully narrows the attacker population to insiders or those who have compromised an account. Impact is constrained: no confidentiality impact (C:N), only partial integrity (I:L, data modification) and partial availability (A:L, denial of service) - notably the integrity impact is limited rather than a full database read, which is unusual for SQLi and suggests restricted injection context. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this reads as a real but lower-priority issue rather than an urgent one. Patch availability from IBM means remediation should be straightforward. In short: a genuine authenticated SQLi worth patching on a normal cycle, not an emergency, absent any exploitation signal.

An attacker who has obtained low-privilege authenticated access to IBM Security Verify Access or Verify Identity Access submits crafted input to a parameter that is concatenated into a backend SQL query. By manipulating the query they modify stored data and can trigger a denial of service. No public proof-of-concept was identified in the provided data, and exploitation requires valid credentials.