IBM Security Verify Access CVE-2026-19482

Requires a valid low-privilege authenticated session on an affected IBM Security Verify Access (10.0 through 10.0.9.2) or IBM Verify Identity Access (11.0 through 11.0.3) instance, including the containerized variants. Exploitation then depends on reaching the function that passes attacker-influenced command arguments into a backend process without proper neutralization (CWE-88). Limiting factors: the attacker must hold credentials (PR:L - exploitation is not possible fully unauthenticated), restricting the realistic threat set to insiders or attackers who have already obtained a low-privilege account; no user interaction is required (UI:N) and the vector is network-reachable (AV:N). The input does not specify a non-default feature or configuration prerequisite, so default deployments within the affected version ranges should be considered exposed to any authenticated user.

This is a credible, actionable priority rather than a paper-tiger high-CVSS issue, though not a top-of-queue emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, yielding full C:H/I:H/A:H impact consistent with arbitrary command execution (CWE-88, argument injection). The authentication requirement (PR:L) is a meaningful limiting factor: an attacker must already hold some valid, low-privilege account on the IBM Security Verify Access / Verify Identity Access instance, which narrows the threat to insiders, credential-phishing outcomes, or chained access. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public POC referenced, so current status is: no public exploit identified at time of analysis - meaning risk is driven by potential rather than observed mass exploitation. Because this product is a security/identity gateway, successful command execution is high-consequence (it sits at the authentication control plane), which argues for prompt patching despite the absence of active-exploitation signals. The signals are internally consistent - no conflicts between CVSS vector and description were detected (both point to remote, authenticated, high-impact execution).

A remote attacker who already holds a low-privilege authenticated account (or obtained one via phishing/credential reuse) submits a request containing specially crafted command arguments that are improperly neutralized, injecting additional arguments or commands into a backend invocation. This results in arbitrary command execution on the appliance with the privileges of the affected process, compromising the identity/access gateway itself. No public proof-of-concept exploit was identified in the provided intelligence.